View Single Post
  #47  
Old 13-09-2015, 12:07
Shegorat's Avatar
Shegorat Shegorat is offline
Registered User
 
Join Date: Sep 2015
Location: Shivering Isles
Posts: 15
Thanks: 2
Thanked 90 Times in 13 Posts
Shegorat is on a distinguished road
Maybe i can explain some features of precomp and reflate...

Precomp searches only zlib streams, zlib is only container for deflate stream with his own header. Precomp can try to search deflate streams in brute mode, but very very slowly. It can handle recursive compressed streams, and input files more than 4 Gb.

Reflate try to search deflate streams, it is more difficult, cause deflate stream is sequence of compressed blocks, every block starts with 3 bits header. So rawdet can find many false-positive streams. But there are some checks in rawdet, that can drop almost all invalid streams. Rawdet can not handle input files more than 4 Gb, and recursive compressed streams - for each unpacked stream need run rawdet again.

Sometimes using both precomp and reflate may get better results, than using one of them.
Reply With Quote
The Following 12 Users Say Thank You to Shegorat For This Useful Post:
78372 (15-11-2017), Bilawal (14-09-2015), buttignol (17-09-2015), ChronoCross (13-09-2015), COPyCAT (03-10-2015), gozarck (10-10-2015), kassane (17-09-2015), Miravinder (17-09-2015), RamiroCruzo (13-09-2015), Razor12911 (13-09-2015), Stor31 (17-09-2015), y_thelastknight (26-09-2015)