Module context 

Targeted extraction from the decrypted CoreStorage metadata.

The com.apple.corestorage.lvf.encryption.context XML plist carries the password protector’s wrapped keys; block type 0x001a carries the logical volume’s familyUUID (the tweak-key input) and its size. A full plist parser is unnecessary and would be more attack surface: the values we need appear as <key>NAME</key><data ID=..>BASE64</data> and <key>NAME</key><string ID=..>VALUE</string> pairs, so bounded substring extraction is used (RESEARCH.md explicitly sanctions this). Every scan is bounds-checked and length-capped.

Structs

EncryptionContext

The password protector’s wrapped-key material and PBKDF2 parameters.

LogicalVolumeInfo

The LV logical size (bytes) and family UUID, from the decrypted metadata.

Protector

A CoreStorage crypto-user (protector) classified by its UserType code.

Enums

ProtectorKind

Classification of a CoreStorage crypto-user UserType.