无法解压缩ZLIB / DEFLATE数据 [英] Cannot decompress ZLIB/DEFLATE data

问题描述

我尝试从网络捕获文件（PCAP）的压缩字节中提取数据

I'm trying to extract data from compressed bytes from network capture file (PCAP.)

其中一些数据包的数据没有ZLIB头前2个字节，其中第一个字节的低4位总是8），因此在尝试使用 ZlibStream 解压缩时给出异常。

Data from some of these packets don't have ZLIB header (the first 2 bytes, where lower 4 bits of first byte is always 8) and hence gave exception when I tried to decompress it using ZlibStream. Data with headers seem to work fine.

根据我的理解，ZLIB只是一个头和脚注超过DEFLATE，我将这些没有头文件的数据传递给 DeflateStream 。这个时间 DeflateStream 不会抛出任何错误，它只是给错了数据（但它给出了正确的长度）...

As I understand that ZLIB is just a header and footer over DEFLATE, I pass these data without headers to DeflateStream. This time DeflateStream doesn't throw any error, it just gave wrong data (but it gave correct length) ...

这是一个示例数据。 C＃代码示例使用DotNetZip：

This is a sample data. The C# code sample uses DotNetZip:

byte[] test3 = new byte[] { 0x1a, 0x6d, 0xf, 0x8d, 0xb6, 0x87, 0x46, 0xdb, 0x43, 0xa3, 0xed, 0xa1, 0xd1, 
                0xf6, 0xd0, 0x68, 0x7b, 0x68, 0xb4, 0x3d, 0x34, 0xda, 0x1e, 0xb2, 0x44, 0x3a, 0x39, 0x6f, 0x24, 
                0xae, 0x1f, 0x2, 0x0, 0x0, 0x0, 0xff, 0xff };


static void UncompressData(byte[] data)
{
    if ((data[0] & 0x0F) != 0x08)
    {        
        var uncompressed = DeflateStream.UncompressBuffer(data);
        Console.WriteLine("Uncompressed Deflate data : {0} => {1} bytes", data.Length, uncompressed.Length);
    }
    else
    {
        var uncompressed = ZlibStream.UncompressBuffer(data);
        Console.WriteLine("Uncompressed ZLIB data : {0} => {1} bytes", data.Length, uncompressed.Length);
    }
}

我用C＃的系统测试.IO.Compression.DeflateStream ， Ionic.Zlib.DeflateStream （来自 DotNetZip ）和Java的 java.util.zip.Inflater 。所有给出了类似的数组，其中包含0个。

I tested with C#'s System.IO.Compression.DeflateStream, Ionic.Zlib.DeflateStream (from DotNetZip), and Java's java.util.zip.Inflater. All gave similar array full of 0s ..

关于什么可能缺少这里的任何想法？可能ZLIB / DEFLATE是有状态的，解压缩需要来自所有先前数据包的数据吗？

Any idea on what could be missing here? Is is possible that ZLIB/DEFLATE is stateful and the decompression required data from all prior packets?

谢谢。

推荐答案

文件，则不能单独对单个数据包进行放缩。

Yes, you need the entire "file", you can't deflate individual packets in isolation.

从zlib文档中，可以从文件中的各个点开始放弃。然而，你需要完全控制压缩的一半拼图，因为你必须知道那些点是为了开始放气从那里。他们仍然（可能）不会打破包边界。

From the zlib documentation, it is possible to start deflate from various points within the file. However, you need to have full control over the compression half of the puzzle, since you have to know exactly where those points are in order to start deflate from there. And they still (probably) wouldn't break on "packet" boundaries.

这篇关于无法解压缩ZLIB / DEFLATE数据的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！