Corrupt input data about unitypy HOT 3 OPEN

Thanks for the report.
The fix you proposed wouldn't fix the root of the issue,
which is probably a false flag detection.
I will look into it in the coming days.

from unitypy.

I noticed that the data in question is compressed via lzma.FORMAT_ALONE which is the legacy lzma format.

So I checked how the properties are encoded in that format and found the following code

void DecodeProperties(const Byte *properties)
  {
    unsigned d = properties[0];
    if (d >= (9 * 5 * 5))
      throw "Incorrect LZMA properties";
    lc = d % 9;
    d /= 9;
    pb = d / 5;
    lp = d % 5;
    dictSizeInProperties = 0;
    for (int i = 0; i < 4; i++)
      dictSizeInProperties |= (UInt32)properties[i + 1] << (8 * i);
    dictSize = dictSizeInProperties;
    if (dictSize < LZMA_DIC_MIN)
      dictSize = LZMA_DIC_MIN;
  }

which is pretty much the same as the current python code besides the min dict size.

So it's better to simply use lzma.decompress(data, format = lzma.FORMAT_ALONE) .

I'm going to run some tests now to confirm this.

from unitypy.

Hm,
according to my tests it's not exactly the same.
I found a good way to identify the compression format tho.

When the ALONE format is used, data[5] equals 255,
if the specific compressor is used, it equals 0.

I'm going to run some further tests and so how it goes with that.

from unitypy.