/*

 * Encrypted metadata functions

 *

 * Copyright (C) 2011-2024, Omar Choudary <choudary.omar@gmail.com>

 *                          Joachim Metz <joachim.metz@gmail.com>

 *

 * Refer to AUTHORS for acknowledgements.

 *

 * This program is free software: you can redistribute it and/or modify

 * it under the terms of the GNU Lesser General Public License as published by

 * the Free Software Foundation, either version 3 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>.

 */

#include <common.h>

#include <byte_stream.h>

#include <memory.h>

#include <narrow_string.h>

#include <system_string.h>

#include <types.h>

#include "libfvde_checksum.h"

#include "libfvde_compression.h"

#include "libfvde_debug.h"

#include "libfvde_definitions.h"

#include "libfvde_encrypted_metadata.h"

#include "libfvde_encryption_context.h"

#include "libfvde_encryption_context_plist.h"

#include "libfvde_io_handle.h"

#include "libfvde_keyring.h"

#include "libfvde_libbfio.h"

#include "libfvde_libcdata.h"

#include "libfvde_libcerror.h"

#include "libfvde_libcnotify.h"

#include "libfvde_libfguid.h"

#include "libfvde_libfplist.h"

#include "libfvde_libfvalue.h"

#include "libfvde_logical_volume_descriptor.h"

#include "libfvde_metadata_block.h"

#include "libfvde_password.h"

#include "libfvde_segment_descriptor.h"

#include "fvde_metadata.h"

/* Some constants used for FileVault medatada

 */

const uint32_t additional_offset_encrypted_volume_start = 80;

const uint8_t libfvde_encrypted_metadata_wrapped_kek_initialization_vector[ 8 ] = {

  0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6, 0xa6 };

/* Creates encrypted metadata

 * Make sure the value encrypted_metadata is referencing, is set to NULL

 * Returns 1 if successful or -1 on error

 */

int libfvde_encrypted_metadata_initialize(

     libfvde_encrypted_metadata_t **encrypted_metadata,

     libcerror_error_t **error )

{

  static char *function = "libfvde_encrypted_metadata_initialize";

  if( encrypted_metadata == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid encrypted metadata.",

     function );

    return( -1 );

  }

  if( *encrypted_metadata != NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_VALUE_ALREADY_SET,

     "%s: invalid encrypted metadata value already set.",

     function );

    return( -1 );

  }

  *encrypted_metadata = memory_allocate_structure(

                         libfvde_encrypted_metadata_t );

  if( *encrypted_metadata == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_MEMORY,

     LIBCERROR_MEMORY_ERROR_INSUFFICIENT,

     "%s: unable to create encrypted metadata.",

     function );

    goto on_error;

  }

  if( memory_set(

       *encrypted_metadata,

       0,

       sizeof( libfvde_encrypted_metadata_t ) ) == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_MEMORY,

     LIBCERROR_MEMORY_ERROR_SET_FAILED,

     "%s: unable to clear encryped metadata.",

     function );

    memory_free(

     *encrypted_metadata );

    *encrypted_metadata = NULL;

    return( -1 );

  }

  if( libfvde_encryption_context_plist_initialize(

       &( ( *encrypted_metadata )->encryption_context_plist ),

       error ) != 1 )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,

     "%s: unable to create encryption context plist.",

     function );

    goto on_error;

  }

  if( libcdata_array_initialize(

       &( ( *encrypted_metadata )->logical_volume_descriptors ),

       0,

       error ) != 1 )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,

     "%s: unable to create logical volume descriptors array.",

     function );

    goto on_error;

  }

  if( libcdata_array_initialize(

       &( ( *encrypted_metadata )->segment_descriptors_0x0304 ),

       0,

       error ) != 1 )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_INITIALIZE_FAILED,

     "%s: unable to create segment descriptors array.",

     function );

    goto on_error;

  }

  return( 1 );

on_error:

  if( *encrypted_metadata != NULL )

  {

    if( ( *encrypted_metadata )->logical_volume_descriptors != NULL )

    {

      libcdata_array_free(

       &( ( *encrypted_metadata )->logical_volume_descriptors ),

       NULL,

       NULL );

    }

    if( ( *encrypted_metadata )->encryption_context_plist != NULL )

    {

      libfvde_encryption_context_plist_free(

       &( ( *encrypted_metadata )->encryption_context_plist ),

       NULL );

    }

    memory_free(

     *encrypted_metadata );

    *encrypted_metadata = NULL;

  }

  return( -1 );

}

/* Frees encrypted metadata

 * Returns 1 if successful or -1 on error

 */

int libfvde_encrypted_metadata_free(

     libfvde_encrypted_metadata_t **encrypted_metadata,

     libcerror_error_t **error )

{

  static char *function = "libfvde_encrypted_metadata_free";

  int result            = 1;

  if( encrypted_metadata == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid encrypted metadata.",

     function );

    return( -1 );

  }

  if( encrypted_metadata != NULL )

  {

    if( libfvde_encryption_context_plist_free(

         &( ( *encrypted_metadata )->encryption_context_plist ),

         error ) != 1 )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,

       "%s: unable to free encryption context plist.",

       function );

      result = -1;

    }

    if( libcdata_array_free(

         &( ( *encrypted_metadata )->logical_volume_descriptors ),

         (int (*)(intptr_t **, libcerror_error_t **)) &libfvde_logical_volume_descriptor_free,

         error ) != 1 )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,

       "%s: unable to free logical volume descriptors array.",

       function );

      result = -1;

    }

    if( libcdata_array_free(

         &( ( *encrypted_metadata )->segment_descriptors_0x0304 ),

         (int (*)(intptr_t **, libcerror_error_t **)) &libfvde_segment_descriptor_free,

         error ) != 1 )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_FINALIZE_FAILED,

       "%s: unable to free segment descriptors array.",

       function );

      result = -1;

    }

    if( ( *encrypted_metadata )->encryption_context_plist_data != NULL )

    {

      memory_free(

       ( *encrypted_metadata )->encryption_context_plist_data );

    }

    if( ( *encrypted_metadata )->compressed_data != NULL )

    {

      memory_free(

       ( *encrypted_metadata )->compressed_data );

    }

    memory_free(

     *encrypted_metadata );

    *encrypted_metadata = NULL;

  }

  return( result );

}

/* Reads the encrypted metadata block type 0x0010

 * Returns 1 if successful or -1 on error

 */

int libfvde_encrypted_metadata_read_type_0x0010(

     libfvde_encrypted_metadata_t *encrypted_metadata,

     const uint8_t *block_data,

     size_t block_data_size,

     libcerror_error_t **error )

{

  static char *function    = "libfvde_encrypted_metadata_read_type_0x0010";

#if defined( HAVE_DEBUG_OUTPUT )

  uint64_t value_64bit     = 0;

  uint32_t value_32bit     = 0;

  uint16_t value_16bit     = 0;

  int metadata_block_index = 0;

#endif

  if( encrypted_metadata == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid encrypted metadata.",

     function );

    return( -1 );

  }

  if( block_data == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid block data.",

     function );

    return( -1 );

  }

  if( ( block_data_size < 344 )

   || ( block_data_size > (size_t) SSIZE_MAX ) )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,

     "%s: invalid block data size value out of bounds.",

     function );

    return( -1 );

  }

#if defined( HAVE_DEBUG_OUTPUT )

  if( libcnotify_verbose != 0 )

  {

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 0 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown1\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 8 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: checksum\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 12 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: initial value\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint16_little_endian(

     &( block_data[ 16 ] ),

     value_16bit );

    libcnotify_printf(

     "%s: format version\t\t\t: %" PRIu16 "\n",

     function,

     value_16bit );

    byte_stream_copy_to_uint16_little_endian(

     &( block_data[ 18 ] ),

     value_16bit );

    libcnotify_printf(

     "%s: block type\t\t\t\t: 0x%04" PRIx16 "\n",

     function,

     value_16bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 20 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: serial number\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint64_little_endian(

     &( block_data[ 24 ] ),

     value_64bit );

    libcnotify_printf(

     "%s: unknown2\t\t\t\t: 0x%08" PRIx64 "\n",

     function,

     value_64bit );

    byte_stream_copy_to_uint64_little_endian(

     &( block_data[ 32 ] ),

     value_64bit );

    libcnotify_printf(

     "%s: unknown3a\t\t\t\t: 0x%08" PRIx64 "\n",

     function,

     value_64bit );

    byte_stream_copy_to_uint64_little_endian(

     &( block_data[ 40 ] ),

     value_64bit );

    libcnotify_printf(

     "%s: unknown3b\t\t\t\t: 0x%08" PRIx64 "\n",

     function,

     value_64bit );

    byte_stream_copy_to_uint64_little_endian(

     &( block_data[ 48 ] ),

     value_64bit );

    libcnotify_printf(

     "%s: unknown3c\t\t\t\t: 0x%08" PRIx64 "\n",

     function,

     value_64bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 56 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: bytes per sector\t\t\t: %" PRIu32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 60 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown4a\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint64_little_endian(

     &( block_data[ 64 ] ),

     value_64bit );

    libcnotify_printf(

     "%s: unknown4b\t\t\t\t: 0x%08" PRIx64 "\n",

     function,

     value_64bit );

    byte_stream_copy_to_uint64_little_endian(

     &( block_data[ 72 ] ),

     value_64bit );

    libcnotify_printf(

     "%s: physical volume size\t\t: %" PRIu64 "\n",

     function,

     value_64bit );

    libcnotify_printf(

     "%s: unknown5:\n",

     function );

    libcnotify_print_data(

     &( block_data[ 80 ] ),

     16,

     0 );

    libcnotify_printf(

     "%s: core storage signature\t\t: %c%c\n",

     function,

     block_data[ 96 ],

     block_data[ 97 ] );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 98 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: checksum algorithm\t\t\t: %" PRIu32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint16_little_endian(

     &( block_data[ 102 ] ),

     value_16bit );

    libcnotify_printf(

     "%s: unknown6\t\t\t\t: 0x%04" PRIx16 "\n",

     function,

     value_16bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 104 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: block size\t\t\t\t: %" PRIu32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 108 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: metadata size\t\t\t: %" PRIu32 "\n",

     function,

     value_32bit );

    for( metadata_block_index = 0;

         metadata_block_index < 4;

         metadata_block_index++ )

    {

      byte_stream_copy_to_uint64_little_endian(

       &( block_data[ 112 + ( metadata_block_index * 8 ) ] ),

       value_64bit );

      libcnotify_printf(

       "%s: metadata: %d block number\t\t: %" PRIu64 "\n",

       function,

       metadata_block_index + 1,

       value_64bit );

    }

    libcnotify_printf(

     "%s: unknown7:\n",

     function );

    libcnotify_print_data(

     &( block_data[ 144 ] ),

     32,

     0 );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 176 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: key data size\t\t\t: %" PRIu32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 180 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: encryption method\t\t\t: %" PRIu32 "\n",

     function,

     value_32bit );

    libcnotify_printf(

     "%s: key data:\n",

     function );

    libcnotify_print_data(

     &( block_data[ 184 ] ),

     128,

     LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );

    if( libfvde_debug_print_guid_value(

         function,

         "physical volume identifier\t\t",

         &( block_data[ 312 ] ),

         16,

         LIBFGUID_ENDIAN_BIG,

         LIBFGUID_STRING_FORMAT_FLAG_USE_LOWER_CASE,

         error ) != 1 )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,

       "%s: unable to print GUID value.",

       function );

      return( -1 );

    }

    if( libfvde_debug_print_guid_value(

         function,

         "logical volume group identifier\t",

         &( block_data[ 328 ] ),

         16,

         LIBFGUID_ENDIAN_BIG,

         LIBFGUID_STRING_FORMAT_FLAG_USE_LOWER_CASE,

         error ) != 1 )

    {

      libcerror_error_set(

       error,

       LIBCERROR_ERROR_DOMAIN_RUNTIME,

       LIBCERROR_RUNTIME_ERROR_PRINT_FAILED,

       "%s: unable to print GUID value.",

       function );

      return( -1 );

    }

    libcnotify_printf(

     "\n" );

  }

#endif /* defined( HAVE_DEBUG_OUTPUT ) */

  return( 1 );

}

/* Reads the encrypted metadata block type 0x0011

 * Returns 1 if successful or -1 on error

 */

int libfvde_encrypted_metadata_read_type_0x0011(

     libfvde_encrypted_metadata_t *encrypted_metadata,

     const uint8_t *block_data,

     size_t block_data_size,

     libcerror_error_t **error )

{

  static char *function      = "libfvde_encrypted_metadata_read_type_0x0011";

  size_t block_data_offset   = 0;

  uint32_t entry_index       = 0;

  uint32_t number_of_entries = 0;

#if defined( HAVE_DEBUG_OUTPUT )

  uint64_t value_64bit       = 0;

  uint32_t value_32bit       = 0;

  uint16_t value_16bit       = 0;

#endif

  if( encrypted_metadata == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid encrypted metadata.",

     function );

    return( -1 );

  }

  if( block_data == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid block data.",

     function );

    return( -1 );

  }

  if( ( block_data_size < 192 )

   || ( block_data_size > (size_t) SSIZE_MAX ) )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,

     "%s: invalid block data size value out of bounds.",

     function );

    return( -1 );

  }

#if defined( HAVE_DEBUG_OUTPUT )

  if( libcnotify_verbose != 0 )

  {

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 0 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: metadata size\t\t\t: %" PRIu32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 4 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown1\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 8 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: checksum\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 12 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: initial value\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 16 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown2\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 20 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown3\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 24 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown4\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 28 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown5\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    libcnotify_printf(

     "%s: unknown6:\n",

     function );

    libcnotify_print_data(

     &( block_data[ 32 ] ),

     40,

     LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 72 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown7\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 76 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown8\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    libcnotify_printf(

     "%s: unknown9:\n",

     function );

    libcnotify_print_data(

     &( block_data[ 80 ] ),

     24,

     LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 104 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown10\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 108 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown11\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 112 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown12\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint16_little_endian(

     &( block_data[ 116 ] ),

     value_16bit );

    libcnotify_printf(

     "%s: unknown13a\t\t\t\t: 0x%04" PRIx16 "\n",

     function,

     value_16bit );

    byte_stream_copy_to_uint16_little_endian(

     &( block_data[ 118 ] ),

     value_16bit );

    libcnotify_printf(

     "%s: unknown13b\t\t\t\t: 0x%04" PRIx16 "\n",

     function,

     value_16bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 120 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown14\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint16_little_endian(

     &( block_data[ 124 ] ),

     value_16bit );

    libcnotify_printf(

     "%s: unknown15a\t\t\t\t: 0x%04" PRIx16 "\n",

     function,

     value_16bit );

    byte_stream_copy_to_uint16_little_endian(

     &( block_data[ 126 ] ),

     value_16bit );

    libcnotify_printf(

     "%s: unknown15b\t\t\t\t: 0x%04" PRIx16 "\n",

     function,

     value_16bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 128 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown16\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    libcnotify_printf(

     "%s: unknown17:\n",

     function );

    libcnotify_print_data(

     &( block_data[ 132 ] ),

     24,

     LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 156 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: volume groups descriptor offset\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 160 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: volume group XML offset\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 164 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: volume group XML size\t\t: %" PRIu32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 168 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: volume group XML size copy\t\t: %" PRIu32 "\n",

     function,

     value_32bit );

    byte_stream_copy_to_uint16_little_endian(

     &( block_data[ 172 ] ),

     value_16bit );

    libcnotify_printf(

     "%s: unknown18\t\t\t\t: 0x%04" PRIx16 "\n",

     function,

     value_16bit );

    byte_stream_copy_to_uint16_little_endian(

     &( block_data[ 174 ] ),

     value_16bit );

    libcnotify_printf(

     "%s: physical volume index\t\t: %" PRIu16 "\n",

     function,

     value_16bit );

    byte_stream_copy_to_uint64_little_endian(

     &( block_data[ 176 ] ),

     value_64bit );

    libcnotify_printf(

     "%s: volume group number of blocks\t: %" PRIu64 "\n",

     function,

     value_64bit );

    libcnotify_printf(

     "\n" );

  }

#endif /* defined( HAVE_DEBUG_OUTPUT ) */

  byte_stream_copy_to_uint32_little_endian(

   &( block_data[ 184 ] ),

   number_of_entries );

#if defined( HAVE_DEBUG_OUTPUT )

  if( libcnotify_verbose != 0 )

  {

    libcnotify_printf(

     "%s: number of entries\t\t\t: %" PRIu32 "\n",

     function,

     number_of_entries );

    byte_stream_copy_to_uint32_little_endian(

     &( block_data[ 188 ] ),

     value_32bit );

    libcnotify_printf(

     "%s: unknown19\t\t\t\t: 0x%08" PRIx32 "\n",

     function,

     value_32bit );

    libcnotify_printf(

     "\n" );

  }

#endif

  block_data_offset = 192;

  if( number_of_entries > ( ( block_data_size - block_data_offset ) / 24 ) )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_RUNTIME,

     LIBCERROR_RUNTIME_ERROR_VALUE_OUT_OF_BOUNDS,

     "%s: invalid number of entries value out of bounds.",

     function );

    return( -1 );

  }

  for( entry_index = 0;

       entry_index < number_of_entries;

       entry_index++ )

  {

#if defined( HAVE_DEBUG_OUTPUT )

    if( libcnotify_verbose != 0 )

    {

      byte_stream_copy_to_uint64_little_endian(

       &( block_data[ block_data_offset ] ),

       value_64bit );

      libcnotify_printf(

       "%s: entry: %03d unknown1\t\t: %" PRIu64 "\n",

       function,

       entry_index,

       value_64bit );

      byte_stream_copy_to_uint64_little_endian(

       &( block_data[ block_data_offset + 8 ] ),

       value_64bit );

      libcnotify_printf(

       "%s: entry: %03d unknown2\t\t: 0x%08" PRIx64 "\n",

       function,

       entry_index,

       value_64bit );

      byte_stream_copy_to_uint64_little_endian(

       &( block_data[ block_data_offset + 16 ] ),

       value_64bit );

      libcnotify_printf(

       "%s: entry: %03d metadata block number\t: %" PRIu64 "\n",

       function,

       entry_index,

       value_64bit );

      libcnotify_printf(

       "\n" );

    }

#endif /* defined( HAVE_DEBUG_OUTPUT ) */

    block_data_offset += 24;

  }

  return( 1 );

}

/* Reads the encrypted metadata block type 0x0012

 * Returns 1 if successful or -1 on error

 */

int libfvde_encrypted_metadata_read_type_0x0012(

     libfvde_encrypted_metadata_t *encrypted_metadata,

     const uint8_t *block_data,

     size_t block_data_size,

     libcerror_error_t **error )

{

  const uint8_t *xml_plist_data = NULL;

  static char *function         = "libfvde_encrypted_metadata_read_type_0x0012";

  if( encrypted_metadata == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid encrypted metadata.",

     function );

    return( -1 );

  }

  if( block_data == NULL )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_INVALID_VALUE,

     "%s: invalid block data.",

     function );

    return( -1 );

  }

  if( ( block_data_size < 54 )

   || ( block_data_size > (size_t) SSIZE_MAX ) )

  {

    libcerror_error_set(

     error,

     LIBCERROR_ERROR_DOMAIN_ARGUMENTS,

     LIBCERROR_ARGUMENT_ERROR_VALUE_OUT_OF_BOUNDS,

     "%s: invalid block data size value out of bounds.",

     function );

    return( -1 );

  }

  xml_plist_data = &( block_data[ 48 ] );

  if( ( xml_plist_data[ 0 ] == (uint8_t) '<' )

   && ( xml_plist_data[ 1 ] == (uint8_t) 'd' )

   && ( xml_plist_data[ 2 ] == (uint8_t) 'i' )

   && ( xml_plist_data[ 3 ] == (uint8_t) 'c' )

   && ( xml_plist_data[ 4 ] == (uint8_t) 't' ) )

  {

#if defined( HAVE_DEBUG_OUTPUT )

    if( libcnotify_verbose != 0 )

    {

      libcnotify_printf(

       "%s: XML:\n%s\n",

       function,

       (char *) &( block_data[ 48 ] ) );

      libcnotify_printf(

       "\n" );

    }

#endif

  }

/* TODO get com.apple.corestorage.lvg.name */

  return( 1 );

}

/* Reads the encrypted metadata block type 0x0013