引发“无效距离太远”的原因以及如何修改zlib以修复它?

huangapple go评论79阅读模式
英文:

What could cause invalid distance too far back and how to modify zlib to fix it?

问题

I am trying to decompress a raw stream of data from a 3rd party source. The data is compressed with zlib library (version 1.2.13) and transmitted over TCP protocol. I was able to capture both compressed and uncompressed streams of data using WireShark and a mix of reverse engineering methods:

Compressed form: 0xCA 0x05 0xDB 0xC8 0xE8 0x07 0x22 0x01 0x00

Uncompressed form: 0x6D 0x4D 0x7D 0x9B 0x7C 0x07 0x01 0x4E 0x7D 0x9B 0x7C 0x07 0x00

    z_stream strm;
    unsigned char in[9] = {0xCA, 0x05, 0xDB, 0xC8, 0xE8, 0x07, 0x22, 0x01, 0x00};
    unsigned char out[65535] = {0};

    strm.zalloc = Z_NULL;
    strm.zfree = Z_NULL;
    strm.opaque = Z_NULL;

    int ret = inflateInit2(&strm, -15);
    if (ret != Z_OK)
        return ret;

    strm.next_in = (unsigned char *) in;
    strm.avail_in = 9;
    strm.next_out = (unsigned char *) out;
    strm.avail_out = 65535;
    strm.total_out = 0;

    ret = inflate(&strm, Z_SYNC_FLUSH);

Initially, the inflate function returned -3 (with the message "invalid distance too far back"). I then recompiled zlib with two modifications: added the DINFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR flag and changed sane = 0 in the inflateResetKeep function to allow an invalid distance.

After these modifications, calling the inflate function, I am getting the following result (in the output buffer):

0x6D 0x00 0x00 0x00 0x00 0x00 0x01 0x4E 0x00 0x00 0x00 0x00 0x00

I've tried to debug this deflate stream with the infgen tool, but it gives me an error saying "incomplete deflate stream."

There is a chance that the deflate stream comes from a modified zlib library (but I am not sure about it). Could anyone point me in the right direction, please?

英文:

I am trying to decompress a raw stream of data from 3rd party source. The data is compressed with zlib library (version 1.2.13) and transmitted over TCP protocol. I was able to capture both compressed and uncompressed stream of data using WireShark and mix of reverse engineering methods:

Compressed form: 0xCA 0x05 0xDB 0xC8 0xE8 0x07 0x22 0x01 0x00

Uncompressed form: 0x6D 0x4D 0x7D 0x9B 0x7C 0x07 0x01 0x4E 0x7D 0x9B 0x7C 0x07 0x00

    z_stream strm;
    unsigned char in[9] = {0xCA, 0x05, 0xDB, 0xC8, 0xE8, 0x07, 0x22, 0x01, 0x00};
    unsigned char out[65535] = {0};

    strm.zalloc = Z_NULL;
    strm.zfree = Z_NULL;
    strm.opaque = Z_NULL;

    int ret = inflateInit2(&strm, -15);
    if (ret != Z_OK)
        return ret;

    strm.next_in = (unsigned char *) in;
    strm.avail_in = 9;
    strm.next_out = (unsigned char *) out;
    strm.avail_out = 65535;
    strm.total_out = 0;

    ret = inflate(&strm, Z_SYNC_FLUSH);

Initially, the inflate function returned -3 (with message "invalid distance too far back"). I then recompiled zlib with two modifications: added DINFLATE_ALLOW_INVALID_DISTANCE_TOOFAR_ARRR flag and changed sane = 0 in inflateResetKeep function to allow invalid distance.

After these modifications, calling inflate function I am getting the following result (in output buffer):

0x6D 0x00 0x00 0x00 0x00 0x00 0x01 0x4E 0x00 0x00 0x00 0x00 0x00

I've tried to debug this deflate stream with infgen tool but it gives me an error saying incomplete deflate stream.

There is a chance that the deflate stream comes from modified zlib library (but I am not sure about it). Could anyone point me in right direction, please?

答案1

得分: 6

你的数据是一个deflate流的片段。那些拆开的位如下:

! infgen 3.0 输出
!
固定
文字 ''m
匹配 5 114
infgen 警告:距离太远(114/1)
文字 1 ''N
匹配 4 6
结束
!
存储
infgen 警告:不完整的deflate数据

需要从这段数据之前的113个字节中获取五个字节,这将是deflate流较早部分的一部分。稍后,这五个字节中的四个会再次重复。

仅凭这个deflate流片段无法获取你期望的数据。你期望的 0x4D 0x7D 0x9B 0x7C 0x07 必须来自其他地方。

英文:

Your data is a fragment of a deflate stream. Those bits disassembled are:

! infgen 3.0 output
!
fixed
literal 'm
match 5 114
infgen warning: distance too far back (114/1)
literal 1 'N
match 4 6
end
!
stored
infgen warning: incomplete deflate data

It needs five bytes from 113 bytes before the start of this data, which would be part of an earlier portion of the deflate stream. Later, four of those five bytes that you don't have get repeated again.

It is not possible to get the data you are expecting just from that fragment of a deflate stream. The 0x4D 0x7D 0x9B 0x7C 0x07 you are expecting has to come from somewhere else.

huangapple
  • 本文由 发表于 2023年5月22日 22:28:44
  • 转载请务必保留本文链接:https://go.coder-hub.com/76307220.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定