Support headerless decompression for zlib

[l3fdb33f]

In the gzip module, if the gzip header is not detected, zlib is used by default. However zlib has its own header check: zlib.error: Error -3 while decompressing data: incorrect header check PowerShell payloads compressed using the raw DEFLATE algorithm won't have these headers, so the recommended workaround using the zlib module is typically: zlib.decompress(data, -zlib.MAX_WBITS) Since by default the gzip wrapper only uses the "data" argument, this workaround can't be applied using malduck. Could this second argument (wbits) be passed in if it is included?

The wbits parameter controls the size of the history buffer (or “window size”), and what header and trailer format is expected. It is similar to the parameter for compressobj(), but accepts more ranges of values: −8 to −15: Uses the absolute value of wbits as the window size logarithm. The input must be a raw stream with no header or trailer.

[msm-code]

I see your point.

To help with reproducing and fixing this issue, can you share a data file that you want to extract and a snippet of code that you want to work with it?

For example:

I have a file reproduction.gz (attached)

I want the following code to work:

from malduck import gzip
with open("reproduction.gz") as data:
    plain_data = gzip(data)  # or do we pass wbits=-15 here?

[l3fdb33f]

Sure, instead of that I'll just do a short string demo: from malduck import gzip, unhex import zlib print(zlib.decompress(unhex("0580b109000008c3ae0d3814141d7c3f4c3f7b4522"), -15)) prints b'powershell' but print(malduck.gzip(unhex("0580b109000008c3ae0d3814141d7c3f4c3f7b4522"))) returns the error error: Error -3 while decompressing data: incorrect header check and print(malduck.gzip(unhex("0580b109000008c3ae0d3814141d7c3f4c3f7b4522"), -15)) returns the error TypeError: decompress() takes 2 positional arguments but 3 were given

I would like to use the last command and pass the second argument -15 to zlib.decompress.