Search code examples
compressionlossless-compression

Unknown compression used in block of data, could use some fresh eyes on this


I have a file that consists of compressed blocks of data and I need to figure out what compression was used, so that I can work with the data.

Do you recognize this header ? Does it ring a bell ?

00 04 00 FC FB CF 07 00 00 04 C8 08 20 02 00 C8

I have been staring at the header without much inspiration. I compared against several resources (for instance https://zenhax.com/viewtopic.php?t=27 ) but so far no Joy.

I put together some code and tested Zlib (raw), Lz4, Lz0 and Bzip2 but without any success. I'm running out of ideas and time. So if someone happens to have an 'aha moment', do share.

The header is part of a 10,630 bytes block that expands/deflates/decompresses to a 37,632 bytes block.

I uploaded the 10K block here FYI: https://www107.zippyshare.com/v/sMDeIBgu/file.html

enter image description here


Solution

  • Unix's file command says it's: "TTComp archive data, binary, 1K dictionary". You can find information on the format and software links here. That link says that it is just raw PKWare DCL imploded data. Indeed, this blast code was able to decompress it in its entirety. The result is 37,632 bytes in length.