Skip to content

Add XPRESS (MS-XCA) decompression operations - #2722

Open
MP-GOWTHAM wants to merge 2 commits into
gchq:masterfrom
MP-GOWTHAM:xpress
Open

Add XPRESS (MS-XCA) decompression operations#2722
MP-GOWTHAM wants to merge 2 commits into
gchq:masterfrom
MP-GOWTHAM:xpress

Conversation

@MP-GOWTHAM

Copy link
Copy Markdown

Adds the two XPRESS (MS-XCA) decompression variants as CyberChef operations, closing a gap versus the WIM/WOF tooling that already supports them:

  • XPRESS Decompress - plain LZ77 (MS-XCA section 2.1.1)
  • XPRESS LZ77+Huffman Decompress - Huffman-coded LZ77 (MS-XCA sections 2.1.2/2.1.4), with a required uncompressed-size argument as per the format

Implementation lives in \src/core/lib/XPRESS.mjs\ (15-bit canonical Huffman tables, 2^16-byte window, end-of-data symbol 256, 1 MiB output guard). Ops are registered in the Compression category.

Tests cover the MS-XCA section 3.1 worked examples (plain and LZ77+Huffman) plus a long-offset match case; all 2284 operation tests and 272 node tests pass.

@CLAassistant

CLAassistant commented Aug 13, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@MP-GOWTHAM

Copy link
Copy Markdown
Author

Correction to the PR description: in WIM/WOF tooling it is specifically the LZ77+Huffman variant that does the work - WIM images and Windows Overlay Filter (Compact OS) files use COMPRESSION_FORMAT_XPRESS_HUFF. The two operations themselves are generic MS-XCA decoders and their descriptions already map the plain op to COMPRESSION_FORMAT_XPRESS, so no code change is needed; this is just to keep the record accurate.

The mid-stream end-of-data-as-match(3,1) fallback indexed out[-1] when
the output was still empty, pushing undefined into the result; guard it
the same way the Go and C ports now do. Also raise MAX_DECOMPRESSED
from 1 MiB to 32 MiB (WIM chunks can be up to 32 MiB; WOF is 1 MiB)
and update the author tags to the real email. Found by the FuzzXpress
target added to klauspost/compress.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants