Uncompressing a LZ4 blob with Perl Uncompressing a LZ4 blob with Perl sqlite sqlite

Uncompressing a LZ4 blob with Perl


You data looks like it is LZ4-compressed and prefixed with the four bytes "LZ4\1" presumably as a format indicator

The next four bytes ">\1\0\0" are a little-endian original-size field which evaluates to 318 bytes, which is reasonable. The decompress library function expects this field

So in theory, you should be able to write

$blob = substr($blob(4);dd decompress($blob);

and get the correct result. However this also results in a value of undef for me, which suggests that the data is corrupted somehow

What is certain is that most of the data has ended up uncompressed. The two bytes following the length field are "\xF7\xD6", which indicates that the data following that is 229 bytes of literal data (the upper nybl of the first byte - 0xF - plus the second byte - 0xD6 - is 0xE5 or 229). So this part of the data

"df\xF1mBXML\1\xA1\aVersion\xA1\4Type\xA1\2Id\xA1\3Ref\xA1\4Size\xA1\3use\xA1\4expr\xA1\5value\xA1\4data\xA1/http://www.slb.com/Petrel/2011/03/Serialization\xA1\aPoints3\xA1\tuser_E\0\xF0\16\bvertices\xA1\6double\xA1\bhas_attr\xA1\16\n\0\xC7object_ids\xA1\n\f\0\xF1M\4item\xA1\tis_active\xA0~B\20\n\22\6\4\x8C\1\0\0\0\6\2\xAA\24\6\0\xA4\x82\x88\2\x80\x82\x82\xA6B\26\6\b\x80\1"

is literal, as could be guessed by the amount of readable text it contains

The following two bytes, "B\30" should indicate an offset within the translated buffer from which data should be copied. Unfortunately this evaluates to 6210, whereas, as we have seen, the buffer is only 229 bytes long so far. This is presumably where the data causes the decompress function to balk and return undef

That's the best I can make of your data. I hope it helps