2

I've reversed a decompression routine, but have to figure out the compression.

Because the executable only decrypts and therefor has no compression routine and I'm not comfortable with compressions it's really hard for me.

Here the code I've written in C#:

private unsafe void Decompress(byte[] decom, byte[] com, int comSize) {
        byte[] dict = new byte[4096];
        fixed (byte* pDict = dict, p1 = decom, p2 = com) {
            byte* pDecom = p1, pCom = p2;

            byte next;
            int r6 = 0, r7 = 0xfee, r10, r9;

            while (true) {
                r6 >>= 1;

                if ((r6 & 0x100) == 0) {
                    if (comSize-- == 0)
                        return;

                    r6 = 0xFF00 | *(pCom++);
                }

                if ((r6 & 1) == 1) {
                    if (comSize-- == 0)
                        return;

                    next = *(pCom++);
                    *(pDecom++) = next;
                    *(pDict + r7) = next;
                    r7 = (r7 + 1) & 0xFFF;
                } else {
                    if ((comSize -= 2) <= 0)
                        return;

                    r10 = (*(pCom++) << 8) | *(pCom++);

                    r9 = r10 >> 4;
                    r10 = (r10 & 0xF) + 2;

                    for (int i = r10 + 1; i > 0; --i) {
                        r10 = r9++ & 0xFFF;
                        next = *(pDict + r10);
                        *(pDecom++) = next;
                        *(pDict + r7) = next;
                        r7 = (r7 + 1) & 0xfff;
                    }
                }
            }
        }
    }

It would be nice if someone could identify or post a link to code for the compression. Any help is appreciated.

3

Based on this post, that appears to be an LZ77 variant.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.