18

I know there are tools for identifying common ciphers and hash algorithms in code, but are there any similar scripts / tools / plugins for common compression algorithms such as gzip, deflate, etc? Primarily aimed at x86 and Windows, but answers for other platforms are welcomed too.

Note that I'm looking to find code, not data.

Improve this question
3
  • I wouldn't be supprised it many compression/decompression tools have this since 7zip can often open things regardless of the extension. Althought it is possible it is relying on meta data.
    – cb88
    Apr 1, 2013 at 22:51
  • Tools such as 7zip simply rely on metadata within the executable file in order to detect SFX binaries, but even if it was using heuristics it'd be looking for compressed data, not the compression algorithm. I'm looking for ways to detect the address of the code for common compression algorithms.
    – Polynomial
    Apr 1, 2013 at 22:52
  • 1/ I don't know any tool that does that 2/ it really depends if you want to match C code or optimized ASM code: if you want to match compiled code, it would be better to have a FLIRT-like signature for specific functions. To match hand-optimized ASM (something people rarely alter when copy/pasting), then either match the complete block, or at least, rely on specific constants (example)
    – Ange
    Apr 2, 2013 at 8:01

3 Answers 3

Reset to default
23

signsrch by Luigi Auriemma has signatures for tables used in common compression libraries (zlib etc.).

enter image description here

It has been ported as plugins for ImmDbg and IDA.

He also has the offzip tool which tries to identify and unpack compressed streams inside a binary.

Improve this answer
1
  • This tool is awesome. Looks cross-platform too. Sweet!
    – Polynomial
    Apr 2, 2013 at 7:32
9

I'm a big fan of binwalk, but sadly it doesn't help you much on Windows.

Improve this answer
1
  • their release notes say: " Version 1.0 is a complete re-write in Python and includes new features and a scriptable Python module" Although their FAQ mentions it is not tested on Windows, it should take to much effort to get it working if it isn't.
    – ixje
    Apr 2, 2013 at 6:35
2

If a binary uses deflate or gzip (which uses deflate), the code is generally linked in as a library and thus easy to detect based on string artifacts. This can certainly be automated, e.g., you could simply search for the respective strings. Manually matching functions against the source code is a somewhat tedious process, but it usually works nicely. The process is much more difficult for less common algorithms or when you don't have any artifacts. In that case you have to identify the algorithm by its semantics (things like word size, constants, data structures may provide hints).

In addition to the already mentioned FLIRT signatures: If you use IDA Pro with the Hex-Rays plugin and you are lucky, you may be able to find an algorithm on http://crowd.re. There are a few annotations for compression algorithms available. Apart from that, I am not aware of any tools or scripts that do what you want.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.