Search code examples
c#compressionzlibdotnetzip

Zlib header not detected by offzip


I'm looking into a file that contains some zlib compressed chunks, some are detected by Offzip as valid, one is not:

0x 78 01 F3 48 --valid and has a matching adler32 hash
0x 78 01 03 00 --invalid
0x 78 01 63 64 --valid not sure about the hash

I think it's only the first three bytes that indicate the compression method and flags, so I'm unsure as to why the second entry is not detected. It certainly looks like a zlib data block, but I'm a bit lost

Any input or advice would be greatly appreciated


Solution

  • Those are all valid starts to zlib streams. Of course, none of them are valid entire zlib streams, since the minimum zlib stream length is eight bytes.

    The 78 01 03 00 has a valid zlib header, 78 01, and a valid and in fact complete deflate stream, 03 00. That is an empty fixed codes deflate block marked as the last block. If you follow that with 00 00 00 01 (the Adler-32 check value for zero bytes), then you have a complete and correct zlib stream.