1

I am reversing a Dlink camera firmware (dcs5000l_v1.03.05.bin) and am able to extract lzma data via dd and decompress it via lzma -d lzma_data.lzma. I want to be able to recreate the lzma archive from the extracted file to then later modify it. The problem is, I am not able to recreate the exact lzma file.

Issue 1

When I try to recompress the extracted data, I am able to get the the right properties (byte 0x5d) and dictionary size (0x02000000) via

lzma -8 -z decompressed_data

, but the data is streamed, so the header does contain 0xFFFF... instead of the uncompressed size (0x6b660a, in swapped endianess 0x0a666b).

Here is a comparison of the beginning of the original lzma data and my recreation:

Original

00000000: 5d00 0000 020a 666b 0000 0000 0000 006f  ].....fk.......o

Recreation

00000000: 5d00 0000 02ff ffff ffff ffff ff00 006f  ]..............o

From what I read, the data should only be compressed streamed when the lzma tools gets the data from stdin, but in my case I'm giving the complete file to the tool and would expect that the uncompressed size is written into the header. I dont't know whether my camera could handle streamed mode and would like to create non-streamed lzma data.

Any ideas how I could force that?

Issue 2

Besides that, I also have the issue of the recreated lzma payload beeing different. Starting from position 0000 00B0, the lzma compressed data starts to differ:

Original

000000b0: 2d7b 73cd 13f6 1621 2ea9 ea09 20f1 8a47  -{s....!.... ..G
000000c0: 0c5a 53cc d87f d893 45a2 5196 8960 84dd  .ZS.....E.Q.....

Recreation

000000b0: 2d7b 73cd 13f6 1621 2ea9 ea09 20f1 8a4a  -{s....!.... ..J
000000c0: 4634 378a ac21 efd9 c3e2 3ada 4744 a347  F47..!....:.GD.G

The size of the compressed lzma archives also differs between the original (size: 4522684 bytes) and the recreated file (size: 4521221 bytes). From what I understood the streamed vs. non-streamed issue should not affect the actual compressed data and just append a 5 or 6 bytes end-of-stream marker to the end. So even though I have the right properties and dictionary size, the lzma compressed data differs in my recreation and has a different size.

Do you know why this could be the case and if I can fix it?

1

It’s hard to say for sure, but probably you’re not using the same library version or compression parameters as the original program. The same data may be represented by different compressed streams, so they can change with new versions which make compression more optimal or when you tweak some parameters, e.g. compression level. In general, slight differences in the compressed stream should not matter as long as the decompressed data is the same.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.