Unknown compression.

[yjme]

Hello,

I have some compressed data.

00 EC E3 69 07 91 8C 1C
0D 0C 0E 0C 8C D7 45 18
58 80 42 CD 0D 20 A1 0C
1E 86 DB 22 40 0E 03 23
90 03 14 71 56 04 C9 20
73 18 98 90 65 90 39 0C
CC C8 32 20 CE 6B 2E 86
C3 8A 0C 00

I have a few of them, they all start with 0x00 and most are followed by EC. I was wondering if somebody reconised the format.

Thankyou,

[Surfer]

Try this http://mark0.net/onlinetrid.aspx

[yjme]

Thanks for the suggestion but it is a data stream between my computer and another. The compression is Symantec and I would like to decompress it. It isn't zip but they submit packets which are so I was wondering if someone could help because I'm stumped.

Thanks,

[Shelwien]

1. Make a larger dump file and try precomp on it - http://schnaader.info/precomp.php (-brute)
2. In theory it can be raw lzma (the rangecoder there has a habit of storing extra 0 first), but
there're 9*5*5 possible option combinations and I know nothing about data, so won't really try...
with some default options i've got something like an image out of it, but its likely wrong.
3. The best method probably is hacking the app itself - its probably some custom compression
library anyway.

[yjme]

That sounds right.

Can you tell me what options you used.

It should start with 0x04 and be a series of images about 128x8x8bit with their own headers.

[Shelwien]

http://nishi.dreamhosters.com/u/yjme_0.rar

Now you can try 00-FF as the first byte (there's a random lzma header added before your data)

[yjme]

Which part of the header says how long the new information should be? I do have that information. With regards to the first byte, It seems to be either corrupt data or unreconised filename while I try in Linux, using your application I get a error with execution..

[Shelwien]

> Which part of the header says how long the new information should be?

It doesn't really matter. For a part of a _valid_ lzma stream, my decoder would output all the bytes encoded in it and then stop.

> With regards to the first byte, It seems to be either corrupt data or unreconised filename while I try in Linux

Sure you can't do that with original decoder

> using your application I get a error with execution..

Yeah it could crash for some values of parameter byte, so what?
Parameters leading to a crash are obviously incorrect, right?

Anyway, here I did it for you: http://nishi.dreamhosters.com/u/yjme_1.rar
They all start with 0 though, so its likely not lzma.