1

I have an lzma compressed file that I've extracted from a firmware image (via binwalk) that is X bytes uncompressed and Y bytes compressed.

When I try to compress the extracted file again - without any modification and using the same compression ratio - on my machine (Ubuntu 18.04), I end up with a compressed image that is Z bytes instead of Y bytes.

My guess is that is has to do with the version of lzma that I'm using vs the version that was originally used - is that correct? And if so, is there a way to tell which version of lzma was used originally?

Also, the compressed file extracted from binwalk has the .7z extension, but running file orig_compressed.7z says that it's an lzma file. I'm not sure if that's making a difference.

Edit: the firmware uses the MIPS architecture - I've tried using qemu-system-mipsel to run the MIPS lzma and I still got a compressed file that was a different size than what I'm expecting it to be.

compression_help1234
  • 11
  • 1
  • What happens if you compress it using 7zip instead? Sounds like the file was actually originally compressed using `7z` which implements LZMA, but perhaps does so differently than the `lzma` (`xz`) tool. – terdon Sep 10 '20 at 15:39
  • @terdon if I use `7z` I still don't get the same size and then `file my_compressedFile.7z` will say its "7-zip archive data" instead of "LZMA compressed data" like the original file – compression_help1234 Sep 10 '20 at 15:59
  • You need to tell 7z to use lzma. See `man 7z` (the `-m` option) and `/usr/share/doc/p7zip/DOC/MANUAL/switches/method.htm` to figure out how (sorry, I don't really know these tools). – terdon Sep 10 '20 at 16:02
  • I gave that a shot and it still says that it's a `7-zip archive data` In any case, I have the Makefile for the device that creates the kernel image and it clearly uses `lzma` to perform compression - my guess is that `binwalk` just extracts it as a `.7z` for some reason – compression_help1234 Sep 10 '20 at 16:34
  • How different are Y and Z? Many compressed formats include an original filename (which may be a different length) and a date, both of which may compress differently between the versions. The only true test is to decompress both and cksum them. – Paul_Pedant Sep 10 '20 at 17:26
  • @Paul_Pedant they're about 8KB different. The problem with checksumming the decompressed versions is that each compressed file actually contains another compressed file (same size issue) within it - if that makes sense – compression_help1234 Sep 11 '20 at 17:10

0 Answers0