Search code examples
sqlitecompressionblob

Does SQLite3 compress data


Trying to hack a .db save of a game, here is where one piece of data that should read:

2f 47 61 6d 65 2f 4d 61 70 73 2f 4c 65 76 65 6c 30 31
2f 4c 65 76 65 6c 30 31
5f 4d 61 69 6e 2e
4c 65 76 65 6c 30 31 5f 4d 61 69 6e
3a 50 65 72 73 69 73 74 65 6e 74
4c 65 76 65 6c

but in blob of that save it's actually:

2f 47 61 6d 65 2f 4d 61 70 73 2f 4c 65 76 65 6c 30 31
08 20 68
5f 4d 61 69 6e 2e
0d 20 b1
3a 50 65 72 73 69 73 74 65 6e 74
17 20 a0

It seems replacing redundancy(this is not the whole blob) with 6 hex, does this ring something? Note that DB browser(which doesn't know the game at all) seems to read this with no problem. Since I'm not sure that other parts of the table that DB browser showed is in the same blob section, I can't rule out the chance that's the game compressing it.


Solution

  • It seems clear that it is a simple LZ77 compression, where the three-byte tokens you have identified are references to previous strings. In all three cases the first byte represents the number of bytes back, though for the first two that value is also the length of the repeated string. It is not clear from the example if the string repetition continues after the end of the bytes extracted to show in this question. So it is possible that the first byte represents the length and not the distance. I don't see how the next two bytes should be interpreted.