search

puffyCid / artemis

A cross platform forensic parser written in Rust!
MIT License
61 stars 7 forks source link

Consider using rust-lzxpress or windows-rs #6

Closed puffyCid closed 6 months ago

puffyCid commented 1 year ago

What new feature do you think would be cool to add to artemis? Currently artemis uses the ntapi crate for decompressing proprietary Windows compression formats. It works fine, however Microsoft publishes Rust bindings for large parts of Windows (https://github.com/microsoft/windows-rs). In addition, Comae developers create a pure Rust implantation of the xpress algorithm in Rust (https://github.com/comaeio/rust-lzxpress).

We should probably migrate to one of these solutions instead of using the ntapi crate

Describe the solution you'd like Use rust-lzxpress or windows-rs crate for decompressing Windows compression formats.

Additional context According to the rust-lzxpress README, its slower than the native Windows function. So it might make more sense to try to use windows-rs

puffyCid commented 10 months ago

looking more at rust-lzxpress I dont think it supports all of the lzxpress algorithms. Looks like it only supports LZNT1?