Repository navigation
lzma: also anchor on props 0x6D (OpenWrt lc1/lp2/pb2 kernels) - #56
Closed
fengqiaoqu wants to merge 1 commit into
Closed
fengqiaoqu wants to merge 1 commit into
fengqiaoqu wants to merge 1 commit into
Conversation
The .lzma-alone header has no magic, and the signature only matched props 0x5D. OpenWrt compresses its kernels with lc1/lp2/pb2 (props 0x6D), so the kernel at 0x200 in its factory images went unreported. Add a 6d0000 anchor; the validator's trial decode still filters stray matches. Extend test_lzma.py with an embedded 0x6D stream. Fixes nmatt0#45
Owner
|
already fixed in #57 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #45.
The standalone LZMA signature only anchored on
5d0000, so streams with any other props byte were never offered to the validator. OpenWrt builds its kernels withlzma e -lc1 -lp2 -pb2(props0x6D), which is why the kernel at0x200of the Archer C7 factory image from the issue was missed.This adds a second
[[magic]]anchor for6d0000and updates the comments that described5D 00 00as the only anchor. The validator is unchanged: it already accepts any props up to 224 and trial-decodes to the end marker, so a stray6d 00 00in unrelated data is rejected the same way a stray5d 00 00is.I kept it to the one value seen in the wild rather than enumerating more props bytes. The wildcard-anchor idea from the issue would be the general fix, but it needs schema support and seemed like a separate change.
Testing:
tests/test_lzma.pygets a new case: a props-0x6D stream (Python'slzmawith lc=1, lp=2, pb=2) embedded at0x200, checked for a singleverifiedfinding at that offset and a byte-exact-eextraction. It fails on master and passes with this change.openwrt-23.05.5-ath79-generic-tplink_archer-c7-v2-squashfs-factory.bin,moria -Anow reportslzmaat0x200(7837801 bytes, dict 8 MiB, verified) alongside the squashfs at0x23af40. Scan time on that image went from 0.88 s to 0.97 s, which is the trial decode of the kernel itself.moria_unit,test_samples.py,test_extract.py,test_rae_rfp.py,test_vbf.py, plus the lzma/jzlzma/upx/carve/partition tests all pass on a-Wall -WextraRelease build (gcc, Debian 13).