puffyCid / artemis

A cross platform forensic parser written in Rust!

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Add LZXPRESS+Huffman decompression support without using Windows API

puffyCid opened this issue · comments

What new feature do you think would be cool to add to artemis?
Try to support decompressing LZXPRESS+Huffman data without using Windows API

Describe the solution you'd like
N/A

Additional context
Based on the Velociraptor go-prefetch library, decompressing LZXPRESS+Huffman can be done in less than ~300 lines of Go Code
https://github.com/Velocidex/go-prefetch/blob/master/lzxpress.go

This issue must be resolved before #88 can be started

Looks like a pure rust prefetch parser was impleted at https://github.com/ForensicRS/frnsc-prefetch
It can even decompress Huffman data without Windows APIs.
We just need the decompression part of the code.
Its MIT licensed so it should be straight forward to integrate.