Expand description
Pure-Rust decompressor for Microsoft Xpress-Huffman
(LZXPRESS_HUFFMAN, COMPRESSION_FORMAT_XPRESS_HUFF = 4), specified in
[MS-XCA] §2.2.4.
Xpress-Huffman is the LZ77+Huffman codec that modern Windows uses pervasively:
Win8.1+ prefetch (MAM wrapper), hiberfil.sys, SMB3 compression,
registry-hive compression, and Windows Update payloads. Unlike plain
LZXpress (COMPRESSION_FORMAT_XPRESS = 3, the LZNT-style format the existing
rust-lzxpress / xpress_rs crates implement), this is the Huffman-coded
variant.
This crate is cross-platform — it does not call the Windows
RtlDecompressBufferEx API, so it decompresses Windows artifacts on Linux and
macOS just as well as on Windows. It is panic-free: every length/offset
field read from the (untrusted) input is bounds-checked, never indexed blindly.
let plain = xpress_huffman::decompress(compressed, known_output_size)?;Reimplemented clean-room from the [MS-XCA] algorithm (structure cross-checked
against Fox-IT’s dissect.util; no code copied).
Spec: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-xca/.
Enums§
- Error
- Errors that can arise while decompressing an Xpress-Huffman stream.
Functions§
- decompress
- Decompress an Xpress-Huffman stream into
decompressed_sizebytes.