I am reversing a Dlink camera firmware (dcs5000l_v1.03.05.bin
) and am able to extract lzma data via dd
and decompress it via lzma -d lzma_data.lzma
. I want to be able to recreate the lzma archive from the extracted file to then later modify it. The problem is, I am not able to recreate the exact lzma file.
Issue 1
When I try to recompress the extracted data, I am able to get the the right properties (byte 0x5d
) and dictionary size (0x02000000
) via
lzma -8 -z decompressed_data
, but the data is streamed, so the header does contain 0xFFFF...
instead of the uncompressed size (0x6b660a
, in swapped endianess 0x0a666b
).
Here is a comparison of the beginning of the original lzma data and my recreation:
Original
00000000: 5d00 0000 020a 666b 0000 0000 0000 006f ].....fk.......o
Recreation
00000000: 5d00 0000 02ff ffff ffff ffff ff00 006f ]..............o
From what I read, the data should only be compressed streamed when the lzma tools gets the data from stdin, but in my case I'm giving the complete file to the tool and would expect that the uncompressed size is written into the header. I dont't know whether my camera could handle streamed mode and would like to create non-streamed lzma data.
Any ideas how I could force that?
Issue 2
Besides that, I also have the issue of the recreated lzma payload beeing different. Starting from position 0000 00B0
, the lzma compressed data starts to differ:
Original
000000b0: 2d7b 73cd 13f6 1621 2ea9 ea09 20f1 8a47 -{s....!.... ..G 000000c0: 0c5a 53cc d87f d893 45a2 5196 8960 84dd .ZS.....E.Q.....
Recreation
000000b0: 2d7b 73cd 13f6 1621 2ea9 ea09 20f1 8a4a -{s....!.... ..J 000000c0: 4634 378a ac21 efd9 c3e2 3ada 4744 a347 F47..!....:.GD.G
The size of the compressed lzma archives also differs between the original (size: 4522684 bytes) and the recreated file (size: 4521221 bytes). From what I understood the streamed vs. non-streamed issue should not affect the actual compressed data and just append a 5 or 6 bytes end-of-stream marker to the end. So even though I have the right properties and dictionary size, the lzma compressed data differs in my recreation and has a different size.
Do you know why this could be the case and if I can fix it?