Skip + Deflate

Yesterday, I found myself in quite a mess. I had a file that I needed to inspect – but the file was in a proprietary format. Luckily, it wasn’t difficult to find a description of what I needed to do with the file to actually extract some useful data from it.

It turned out that the file contained some header that includes a version number and a checksum followed by the actual data which was simply a SQLite database encoded with the DeflateStream class of .NET.

The first problem was to skip the header – the first 64 bytes of the file. This was done on my MacBook Air – so luckily, I had Ternimal.app at my disposal – and therefore I could use the “dd” command:

sephiroth:unwrap mbanzon$ dd bs=1 skip=64 if=proprietary of=trimmed
4032+0 records in
4032+0 records out
4032 bytes transferred in 0.015168 secs (265824 bytes/sec)

The “bs” parameter sets the block size to 1 byte and the “skip” parameter tells how many blocks to skip. “in” and “out” defines the input and output files respectively.

After trimming the file from the header, only the “inflated” database file was left. After looking low and high (for about 3 minutes) for a tool on my Mac to deflate the file, I gave up and rolled my own. The result is here, the Deflate class:

using System;
using System.IO.Compression;
using System.IO;

namespace Deflate
{
    class MainClass
    {
        public static void Main (string[] args)
        {
            DeflateStream input = new DeflateStream(new FileStream(args[0], 
                FileMode.Open), CompressionMode.Decompress, false);
            FileStream output = new FileStream(args[1], FileMode.CreateNew);

            byte[] buffer = new byte[4096];

            int read = input.Read(buffer, 0, buffer.Length);
            while (read > 0)
            {
                output.Write(buffer, 0, read);
                read = input.Read(buffer, 0, buffer.Length);
            }

            input.Close();
            output.Close();
        }
    }
}

As seen, the program takes two parameters. The first is the file to be deflated and the second is the name of the output file. Not really rocket science. The only thing left was to run it using Mono.

sephiroth:unwrap mbanzon$ mono Deflate.exe trimmed deflated

And then, open the resulting file using SQLite.

sephiroth:unwrap mbanzon$ sqlite3 deflated
SQLite version 3.7.7 2011-06-25 16:35:41
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite>;

Then all that was left was to query the file and get the results!