Module metadata 

Locate and decrypt the CoreStorage encrypted-metadata region.

Pipeline (see docs/RESEARCH.md, cross-checked against libfvde libfvde_metadata_read_type_0x0011):

1. Read the plaintext metadata region starting at metadata_block_numbers[0] * block_size; its first block has type 0x0011 and its payload carries metadata_size (region length) at payload offset 0 and a volume-groups-descriptor offset at payload 156.
2. At that region-relative descriptor offset, read the encrypted-metadata block count (+8) and the 48-bit primary / secondary block numbers (+32 / +40). Verified on the fvdetest ground truth: count = 6144, primary = 2049.
3. AES-XTS-128 decrypt the encrypted-metadata region: key1 = header key_data, key2 = physical-volume identifier, unit = 8192 bytes, tweak = 0-based unit index within the region.

Structs

EncryptedMetadataLocation

The located encrypted-metadata region, plus everything needed to read it.

SegmentEntry

One logical→physical segment mapping decoded from a 0x0305 block.

Constants

BLOCK_HEADER_SIZE

Fixed 64-byte metadata-block header (checksum, version, type, serial, transaction id, object id, number, block size, …).

Functions

decrypt_metadata

Decrypt an encrypted-metadata region in place over 8192-byte AES-XTS-128 units, tweak = 0-based unit index. Only whole units are decrypted; a trailing partial (never present for a valid region) is left untouched.

locate_encrypted_metadata

Locate the encrypted-metadata region from the full plaintext metadata region.

parse_segments

Parse the segment-descriptor (0x0305) block from decrypted metadata, returning the (logical→physical) segment entries.

plaintext_metadata_region

Byte offset and length of the plaintext metadata region (block mbn[0]).

plaintext_metadata_size

Read the region size (bytes) from the plaintext metadata region’s first block payload, capping against an allocation bomb.