Zlib inflate unexpected decompression errors

0
votes

I am struggling for a few weeks with zlib inflate alghorithm.

I would like to decompress packets from popular game called Tibia. They have compressed it with zlib inflate alghorithms. But it seems something is changed. Can you check it, maybe you will spot something I am missing?

Packet compressed: - cannot be inflated directly (its raw huffman fixed coding - probably)

DA 22 A6 CB 10 99 5F AA 50 9C 9A AA 90 A8 90 05 B4 2F B5 44 41 C3 B1 28 D7 CA 50 53 8F CB B3 44 A1 3C 35 33 3D A3 58 C1 C8 44 CF C0 40 21 BF 4A 0F

Packet decompressed using Reverse Engineering:

B4 16 2D 00 59 6F 75 20 73 65 65 20 61 20 6A 61 63 6B 65 74 20 28 41 72 6D 3A 31 29 2E 0A 49 74 20 77 65 69 67 68 73 20 32 34 2E 30 30 20 6F 7A 2E

Decompressed packet compressed with zlib deflate using CyberChef deflate / php deflate functions:

db 22 a6 cb 10 99 5f aa 50 9c 9a aa 90 a8 90 95 98 9c 9d 5a a2 a0 e1 58 94 6b 65 a8 a9 c7 e5 59 a2 50 9e 9a 99 9e 51 ac 60 64 a2 67 60 a0 90 5f a5 07 00

Data matches in a few places, but generally, its different. Do you know what could be the case?

I attach a picture from RE an inflating function: Screenshot from IdaPro

Here are packets in correct order:

  1. http://wklej.org/hash/6aee9e223f0/txt/ - inflated correctly
  2. http://wklej.org/hash/bd371e7f510/txt/ - inflated correctly
  3. http://wklej.org/hash/8f15935dc15/txt/ - inflated correctly

And here is the packet that cannot be inflated...

CA059BC6043619009FC9FFFFE831
1
c++compressionzlibinflate

1 Answers

0
votes

Your packet that cannot be inflated is likely part of a longer stream of compressed data, with other packets preceding it and following it. You need to decompress all of them as a single stream for the decompression to succeed.

Your first example is a portion of a deflate stream that references data that preceded it. So it is part of a larger deflate stream. You need all of the compressed data that preceded that piece in order to decompress that piece. Your last example (CA05...) also references preceding data, so it too is part of a larger stream with compressed data that preceded it.