gchq/CyberChef

Feature request: Support LZNT1 (de)compression used in Windows' RtlDecompressBuffer and NTFS

Open

#534 opened on Apr 4, 2019

View on GitHub
 (2 comments) (10 reactions) (0 assignees)JavaScript (3,944 forks)batch import
help wantedoperation

Repository metrics

Stars
 (34,843 stars)
PR merge metrics
 (Avg merge 57d 13h) (62 merged PRs in 30d)

Description

Summary

On Windows malware will often compress embedded shellcode/payloads and then use RtlDecompressBuffer to decompress it, with LZNT1 decompression. NTFS also uses this compression method. Here is an example of a pure Python implementation.

Contributor guide

Research direction
Study the LZNT1 algorithm from the provided Python reference and Microsoft documentation. Implement compression and decompression functions in JavaScript, then integrate them into CyberChef's operation structure.
Tech stack
javascript
Domain
backend
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
JavaScriptCompression algorithms
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40