1

I am reversing a Dlink camera firmware (dcs5000l_v1.03.05.bin) and am able to extract lzma data via dd and decompress it via lzma -d lzma_data.lzma. I want to be able to recreate the lzma archive from the extracted file to then later modify it. The problem is, I am not able to recreate the exact lzma file.

Issue 1

When I try to recompress the extracted data, I am able to get the the right properties (byte 0x5d) and dictionary size (0x02000000) via

lzma -8 -z decompressed_data

, but the data is streamed, so the header does contain 0xFFFF... instead of the uncompressed size (0x6b660a, in swapped endianess 0x0a666b).

Here is a comparison of the beginning of the original lzma data and my recreation:

Original

00000000: 5d00 0000 020a 666b 0000 0000 0000 006f  ].....fk.......o

Recreation

00000000: 5d00 0000 02ff ffff ffff ffff ff00 006f  ]..............o

From what I read, the data should only be compressed streamed when the lzma tools gets the data from stdin, but in my case I'm giving the complete file to the tool and would expect that the uncompressed size is written into the header. I dont't know whether my camera could handle streamed mode and would like to create non-streamed lzma data.

Any ideas how I could force that?

Issue 2

Besides that, I also have the issue of the recreated lzma payload beeing different. Starting from position 0000 00B0, the lzma compressed data starts to differ:

Original

000000b0: 2d7b 73cd 13f6 1621 2ea9 ea09 20f1 8a47  -{s....!.... ..G
000000c0: 0c5a 53cc d87f d893 45a2 5196 8960 84dd  .ZS.....E.Q.....

Recreation

000000b0: 2d7b 73cd 13f6 1621 2ea9 ea09 20f1 8a4a  -{s....!.... ..J
000000c0: 4634 378a ac21 efd9 c3e2 3ada 4744 a347  F47..!....:.GD.G

The size of the compressed lzma archives also differs between the original (size: 4522684 bytes) and the recreated file (size: 4521221 bytes). From what I understood the streamed vs. non-streamed issue should not affect the actual compressed data and just append a 5 or 6 bytes end-of-stream marker to the end. So even though I have the right properties and dictionary size, the lzma compressed data differs in my recreation and has a different size.

Do you know why this could be the case and if I can fix it?

2 Answers 2

1

It’s hard to say for sure, but probably you’re not using the same library version or compression parameters as the original program. The same data may be represented by different compressed streams, so they can change with new versions which make compression more optimal or when you tweak some parameters, e.g. compression level. In general, slight differences in the compressed stream should not matter as long as the decompressed data is the same.

1

It's likely that the lzma compressed archive you're working with was generated with an older library version, as Igor said. If you're recompressing the file with your system's built-in lzma command, you might not be getting the right output because it might just be aliased to xz --format=lzma. Refer to your system's man page for xz or lzma to confirm. If lzma is indeed aliased to xz, it's using XZ Utils to compress your archive, which uses a later version of the LZMA SDK.

You can try using LZMA Utils (https://tukaani.org/lzma/), which is based on LZMA SDK 4.32. Simply:

  1. Clone their git repository
git clone https://git.tukaani.org/lzma.git
  1. Run autogen.sh in the project's root directory (make sure to install the required dependencies, like automake and libtoolize)
  2. Run the newly generated configure shell script
  3. Run make to compile the programs
  4. You could run make install, but by this point, you should have a runnable lzma executable in <Project Root>/src/lzma/. You can run the executable directly from this directory without changing your system lzma configuration.

(These instructions are also in the INSTALL file in the project's root directory, but it's fairly difficult to understand first time around. I deciphered it here for convenience.)

You should be able to compress your file by running the following command, assuming in is your input file, out.lzma is your output file, and ~/lzma/src/lzma/lzma is your compiled lzma binary:

~/lzma/src/lzma/lzma -9 -c -z in >out.lzma

I'd suggest trying to recompress the unmodified extracted file to verify this method works before trying to compress the modified file, just in case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.