0

I have a file that I need to find out how to decompress and be able to compress back to the same format

When I used binwalk to get information from the file

binwalk file

returns:

DECIMAL HEXADECIMAL DESCRIPTION


128 0x80 Zlib compressed data, default compression

I have tried to decompress the file using:

zlib-flate -uncompress < r116-v1735.z19

returns:

flate: inflate: data: incorrect header check

I am able to successfully extract the file using

binwalk -Me file

But that doesn't answer my question as to what it used to decompress it. Is there a way to find out what binwalk used?

I have also tried several others such as

gunzip file

tar xvzf file

unzip file

7z x file

bzip2 -dk file

xz -d file

with no success.

  • Binwalk uses the python zlib module – 0xec May 11 '18 at 17:11
  • I know it used that for zlib but if that is the case shouldn't zlib-flate -uncompress work? That is why I am thinking that may it used a different type for extraction. – 0siris May 11 '18 at 17:35
  • Are you sure you're carving out the zlib part correctly before running zlib-flate, you can check the hexdump. – 0xec May 11 '18 at 18:52
  • Confirmed 5a 4c 49 42 , ZLIB in the header of the file. – 0siris May 11 '18 at 19:55
  • I'm afraid that doesn't look like zlib. It should start with 0x78. Check this answer – 0xec May 11 '18 at 21:23

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.