UnityPy
UnityPy copied to clipboard
Corrupt input data
CompressionHelper.py
39: try:
40: return dec.decompress(data[5:])
41: except:
42: return lzma.decompress(data)
it works.
Thanks for the report. The fix you proposed wouldn't fix the root of the issue, which is probably a false flag detection. I will look into it in the coming days.
I noticed that the data in question is compressed via lzma.FORMAT_ALONE which is the legacy lzma format.
So I checked how the properties are encoded in that format and found the following code
void DecodeProperties(const Byte *properties)
{
unsigned d = properties[0];
if (d >= (9 * 5 * 5))
throw "Incorrect LZMA properties";
lc = d % 9;
d /= 9;
pb = d / 5;
lp = d % 5;
dictSizeInProperties = 0;
for (int i = 0; i < 4; i++)
dictSizeInProperties |= (UInt32)properties[i + 1] << (8 * i);
dictSize = dictSizeInProperties;
if (dictSize < LZMA_DIC_MIN)
dictSize = LZMA_DIC_MIN;
}
which is pretty much the same as the current python code besides the min dict size.
So it's better to simply use lzma.decompress(data, format = lzma.FORMAT_ALONE) .
I'm going to run some tests now to confirm this.
Hm, according to my tests it's not exactly the same. I found a good way to identify the compression format tho.
When the ALONE format is used, data[5] equals 255, if the specific compressor is used, it equals 0.
I'm going to run some further tests and so how it goes with that.