Added Zlib extraction

gchq · Jan 11, 2019 · 2307325 · 2307325
1 parent 4e57b4b
commit 2307325
Showing 1 changed file with 32 additions and 1 deletion.
diff --git a/src/core/lib/FileSignatures.mjs b/src/core/lib/FileSignatures.mjs
@@ -828,7 +828,7 @@ export const FILE_SIGNATURES = {
                 0: 0x78,
                 1: [0x1, 0x9c, 0xda, 0x5e]
             },
-            extractor: null
+            extractor: extractZlib
         },
         {
             name: "xz compression",
@@ -1443,6 +1443,37 @@ export function extractGZIP(bytes, offset) {
 }
 
 
+/**
+ * Zlib extractor.
+ *
+ * @param {Uint8Array} bytes
+ * @param {number} offset
+ * @returns {Uint8Array}
+ */
+export function extractZlib(bytes, offset) {
+    const stream = new Stream(bytes.slice(offset));
+
+    // Skip over CMF
+    stream.moveForwardsBy(1);
+
+    // Read flags
+    const flags = stream.readInt(1);
+
+    // Skip over preset dictionary checksum
+    if (flags & 0x20) {
+        stream.moveForwardsBy(4);
+    }
+
+    // Parse DEFLATE stream
+    parseDEFLATE(stream);
+
+    // Skip over final checksum
+    stream.moveForwardsBy(4);
+
+    return stream.carve();
+}
+
+
 /**
  * Steps through a DEFLATE stream
  *