Uncompressing a LZ4 blob with Perl
You data looks like it is LZ4-compressed and prefixed with the four bytes "LZ4\1"
presumably as a format indicator
The next four bytes ">\1\0\0"
are a little-endian original-size field which evaluates to 318 bytes, which is reasonable. The decompress
library function expects this field
So in theory, you should be able to write
$blob = substr($blob(4);dd decompress($blob);
and get the correct result. However this also results in a value of undef
for me, which suggests that the data is corrupted somehow
What is certain is that most of the data has ended up uncompressed. The two bytes following the length field are "\xF7\xD6"
, which indicates that the data following that is 229 bytes of literal data (the upper nybl of the first byte - 0xF - plus the second byte - 0xD6 - is 0xE5 or 229). So this part of the data
"df\xF1mBXML\1\xA1\aVersion\xA1\4Type\xA1\2Id\xA1\3Ref\xA1\4Size\xA1\3use\xA1\4expr\xA1\5value\xA1\4data\xA1/http://www.slb.com/Petrel/2011/03/Serialization\xA1\aPoints3\xA1\tuser_E\0\xF0\16\bvertices\xA1\6double\xA1\bhas_attr\xA1\16\n\0\xC7object_ids\xA1\n\f\0\xF1M\4item\xA1\tis_active\xA0~B\20\n\22\6\4\x8C\1\0\0\0\6\2\xAA\24\6\0\xA4\x82\x88\2\x80\x82\x82\xA6B\26\6\b\x80\1"
is literal, as could be guessed by the amount of readable text it contains
The following two bytes, "B\30"
should indicate an offset within the translated buffer from which data should be copied. Unfortunately this evaluates to 6210, whereas, as we have seen, the buffer is only 229 bytes long so far. This is presumably where the data causes the decompress
function to balk and return undef
That's the best I can make of your data. I hope it helps