search

AgentD / squashfs-tools-ng

A new set of tools and libraries for working with SquashFS images
Other
196 stars 30 forks source link

Switch for detecting compression format per block #26

Closed XVilka closed 4 years ago

XVilka commented 4 years ago

See for example https://github.com/mncoppola/rpef/blob/master/utilities_src/unsquashfs-1.3.c#L176

Some tools can use different compression algorithms from what defined by superblock and can contain multiple compression formats in one image.

See also https://github.com/devttys0/sasquatch/ patchset for more information on various different SquashFS compression configurations.

AgentD commented 4 years ago

The modular nature of the libsquashfs compressor interface should make it easy to implement custom compressors, including ones that try brute-force decompressing with other compressors.

A while back, I pieced together such a thing for a small forensics tool. I should dig that up again and port it to the current state. A sasquatch-like forensic tool could definitely make use of that.

A generic way to detect what compressor was used might not be that easily possible, since not all of them store obvious headers (e.g. LZO).

AgentD commented 4 years ago

Closed in favour of #55