diff --git a/Cargo.lock b/Cargo.lock index 368de6d..2b5252c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -295,7 +295,7 @@ checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0" [[package]] name = "xpress_lz77" -version = "0.1.0" +version = "1.0.0" dependencies = [ "byteorder", "pyo3", diff --git a/Cargo.toml b/Cargo.toml index c831999..861ac95 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "xpress_lz77" -version = "0.1.0" +version = "1.0.0" edition = "2021" # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html diff --git a/README.md b/README.md new file mode 100644 index 0000000..9d1232e --- /dev/null +++ b/README.md @@ -0,0 +1,20 @@ +# xpress lz77 decompression algorithms +xpress LZ77 Plain and xpress LZ77+Huffman Decompression algorithms : A rust implementation using pyo3. + +# Context +Both algorithms are used by microsoft and can help with digital forensics: + +- Windows 1.X prefetch files +- Windows Hibernation + +The use of pyo3 make the creation of a python package possible for integration in python3 tools where decompression performances are required. + +## Use cases + +- https://www.forensicxlab.com/posts/prefetch/ +- https://www.forensicxlab.com/posts/hibernation/ + + +# References + +- Pseudo code algorithm : https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-XCA/%5bMS-XCA%5d.pdf [Section 2.2] diff --git a/log2 b/log2 deleted file mode 100644 index e69de29..0000000 diff --git a/src/xpress_lz77_huffman.rs b/src/xpress_lz77_huffman.rs index 30e40dd..b08012a 100644 --- a/src/xpress_lz77_huffman.rs +++ b/src/xpress_lz77_huffman.rs @@ -1,3 +1,6 @@ +// Huffman+LZ77 Decompression Algorithm +// Reference: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-xca/a8b7cb0a-92a6-4187-a23b-5e14273b96f8 + use std::cell::RefCell; use std::fmt; use std::io::Error;