I must be missing something obvious here. I cannot make sense of the following deflate stream.


% wget https://github.com/lrq3000/mri_protocol/raw/master/SiemensVidaProtocol/Coma%20Science%20Group.exar1
% sqlite3 Coma\ Science\ Group.exar1 "SELECT writefile('ae126b7a3fe86811f981f53cf7cf59cfc1e5bc7c.raw', Data) FROM Content WHERE hash = 'ae126b7a3fe86811f981f53cf7cf59cfc1e5bc7c'"
% file ae126b7a3fe86811f981f53cf7cf59cfc1e5bc7c.raw
ae126b7a3fe86811f981f53cf7cf59cfc1e5bc7c.raw: data

However upon closer look:

% binwalk -X ae126b7a3fe86811f981f53cf7cf59cfc1e5bc7c.raw | head

0             0x0             Raw deflate compression stream

Looking at the entropy (binwalk -EJ), this really looks like a typical deflate algorithm:

enter image description here

But it seems the signature is broken:

% zlib-flate -uncompress < ae126b7a3fe86811f981f53cf7cf59cfc1e5bc7c.raw
flate: inflate: data: incorrect header check

Anyone recognize the compression here ?

1 Answer 1


Turns out this is indeed pure deflate bitstream. zlib-flate is for zlib stream.

% ./decomp.py ae126b7a3fe86811f981f53cf7cf59cfc1e5bc7c.raw | colrm 82
b'EDF V1: ContentType=syngo.MR.ExamDataFoundation.Data.EdfAddInConfigContent;\r\n

With simply:

% cat decomp.py
#!/bin/env python3
import zlib
import sys

with open(sys.argv[1], 'rb') as input_file:
    compressed_data = input_file.read()
    unzipped = zlib.decompress(compressed_data, -zlib.MAX_WBITS)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.