Detecting ZLIB Compression

Published: 2019-08-04
Last Updated: 2019-08-04 20:07:05 UTC
by Didier Stevens (Version: 1)
0 comment(s)

In diary entry "Recognizing ZLIB Compression", I mention my tool it's mainly a wrapper for command file (libmagic).

By default, command file has no definitions to detect ZLIB detection, but my tool uses an additional file with custom definitions:

Take for example a ZLIB compressed stream in a PDF document:

As you can see, the stream starts with 0x78, an indication that this is ZLIB compression.

Piping this stream in my tool helps identifying the unfiltered stream content:

Of course, if you don't want to use this tool, you can just integrate these ZLIB definitions in your own definition files.

Didier Stevens
Senior handler
Microsoft MVP

Keywords: file zlib
0 comment(s)


Diary Archives