
#------------------Compression Formats-----------------------------


# bzip2
0	string BZh91AY&SY	bzip2 compressed data, block size = 900k
0	string BZh81AY&SY	bzip2 compressed data, block size = 800k
0	string BZh71AY&SY	bzip2 compressed data, block size = 700k
0	string BZh61AY&SY	bzip2 compressed data, block size = 600k
0	string BZh51AY&SY	bzip2 compressed data, block size = 500k
0	string BZh41AY&SY	bzip2 compressed data, block size = 400k
0	string BZh31AY&SY	bzip2 compressed data, block size = 300k
0	string BZh21AY&SY	bzip2 compressed data, block size = 200k
0	string BZh11AY&SY	bzip2 compressed data, block size = 100k

# LZO
0	string		\211LZO\000\015\012\032\012	LZO compressed data

# 7-zip archiver, from Thomas Klausner (wiz@danbala.tuwien.ac.at)
# https://www.7-zip.org or DOC/7zFormat.txt
#
0       string          7z\274\257\047\034      7-zip archive data,
>6	byte		<0			invalid
>6	byte		0
>>7	byte		0			invalid
>6	byte		>20			invalid
>6      byte            x                       version %d
>7      byte            x                       \b.%d

# standard unix compress
# Implemented in the compress binwalk plugin.
#0       string		\x1f\x9d\x90          compress'd data, 16 bits

# https://tukaani.org/xz/xz-file-format.txt
0	string		\xFD\x37\x7a\x58\x5a\x00	xz compressed data

# gzip (GNU zip, not to be confused with Info-ZIP or PKWARE zip archiver)
#   Edited by Chris Chittleborough <cchittleborough@yahoo.com.au>, March 2002
#       * Original filename is only at offset 10 if "extra field" absent
#       * Produce shorter output - notably, only report compression methods
#         other than 8 ("deflate", the only method defined in RFC 1952).
#0       string          \037\213\x08    gzip compressed data
0	string		\x1f\x8b\x08	gzip compressed data
>3      byte            &0x01           \b, ASCII
>3	byte&0xE0	!0x00		\b, invalid reserved flag bits
>8	byte		2		\b, maximum compression
>8	byte		4		\b, fastest compression
>8	byte		1		\b, invalid extra flags
>8	byte		3		\b, invalid extra flags
>8	byte		>4		\b, invalid extra flags
>3      byte            &0x02           \b, has header CRC
>3      byte&0x04       0x04
>>10	leshort		x		\b, has %d byte(s) of extra data
>3      byte&0xC        =0x08		\b, has original file name
>>10	string		x		\b{file-name:%s}
>>10    string          x               \b: "%s"
>3      byte            &0x10           \b, has comment
>>3	byte&0xC	0
>>>10	string		x		\b: "%s"
>9      byte            =0x00           \b, from FAT filesystem (MS-DOS, OS/2, NT)
>9      byte            =0x01           \b, from Amiga
>9      byte            =0x02           \b, from VMS
>9      byte            =0x03           \b, from Unix
>9      byte            =0x04           \b, from VM/CMS
>9      byte            =0x05           \b, from Atari
>9      byte            =0x06           \b, from HPFS filesystem (OS/2, NT)
>9      byte            =0x07           \b, from MacOS
>9      byte            =0x08           \b, from Z-System
>9      byte            =0x09           \b, from CP/M
>9      byte            =0x0A           \b, from TOPS/20
>9      byte            =0x0B           \b, from NTFS filesystem (NT)
>9      byte            =0x0C           \b, from QDOS
>9      byte            =0x0D           \b, from Acorn RISCOS
#>9	byte		=0xFF		\b, from ZyNOS
#>9	byte		>0x0D		\b, invalid
#>>9	byte		x		source: 0x%.2X
#>9	byte		<0		\b, invalid
#>>9	byte		x		source: 0x%.2X
>3      byte            &0x20           \b, encrypted (invalid)
# Dates before 1992 are invalid, unless of course you're DD-WRT in which
# case you don't know how to set a date in your gzip files. Brilliant.
>4	lelong		=0		\b, NULL date
>4	lelong		<0		\b, invalid date
>4	lelong		>0
>>4	lelong		<694224000	\b, invalid date
>>4	lelong		=694224000	\b, invalid date
>>4	lelong		>694224000	\b, last modified
>>4     ledate          x               %s

# Zlib signatures
# Too short to be useful on their own; see:
#
#	o src/binwalk/magic/zlib
#	o src/binwalk/plugins/zlib.py
#
#0	beshort		0x789C		zlib compressed data
#0	beshort		0x78DA		zlib compressed data
#0	beshort		0x7801		zlib compressed data


# JAR
0       belong          0xcafed00d      JAR compressed with pack200,
>5      byte            x               version %d.
>4      byte            x               \b%d

# New LZMA format signature
# See lzma file for LZMA signatures
0	string		\xFFLZMA\x00	LZMA compressed data (new),
>6	byte&0x10	0				single-block stream
>6	byte&0x10	0x10			multi-block stream

## LZMA BE
0        byte >0x5a
>0        byte <0x5e
>>5        belong 0xffffffff
>>>1        belong    >0
>>>>1        belong    <0xfffff
>>>>>1        belong    x        LZMA BE compressed data dictionary size: %d bytes
>>6      byte 0xff
>>>1     lelong    0x800000
>>>>5    lelong    <0xfffffff
>>>>>5   lelong    x        LZMA LE compressed data dictionary size: %d bytes
#0	byte	&0
#>0	byte	<0x5f
#>>0	byte	>0x5a
#>>>2	byte	0x00
#>>>>5	belong	>0xff
#>>>>>5	belong	<0xffffff	LZMA BE compressed data dictionary size: %d bytes


# LZMA LE
#0	byte	&0
#>0	byte	>0x5a
#>>0	byte	<0x5e
#>>5     belong 0xffffffff
#>>>1	byte	0x00
#>>>>2	byte	0x00
#>>>>>3	byte	0x80
#>>>>>>5	lelong	>0xff
#>>>>>>>4	lelong	<=0xffffffff	LZMA LE compressed data dictionary size: %d bytes

# hardcoded
#0        string \x5d\x00\x00\x80\x00
#>6	byte 0xff LZME HIDER

#0	string	\xff\x06\x00\x00\x73\x4e\x61\x50\x70\x59	Snappy compression, stream identifier

#0   string	\x1f\x9d\x90	compress'd data, 16 bits

#0	beshort		0x7801		Zlib header, no compression
#0	beshort		0x789c		Zlib compressed data, default compression
#0	beshort		0x78da		Zlib compressed data, best compression
#0	beshort		0x785e		Zlib compressed data, compressed

