Packet Sniffing Howto eliminate SharpZip

[joe7314]

Hi,
I noticed a lot of people are using sharpzip for decompressing compressed packets. Here is some simple code that will eliminate the requirement for having to include sharpzip.

//assuming data is the entire opcode stream withoug the four byte header
//data[0] should equal F6
//data[1] should equal 01 (502)
uint uncompressedLength = data[2]*256+data[3]
//data[4]data[5]data[6]data[7] I dunno but would like to know :)
byte[] input = System.Buffer.BlockCopy((data[8],0, data.length-8)
System.IO.Compression.DeflateStream istream = new System.IO.Compression.DeflateStream(new MemoryStream(input), Compression.CompressionMode.Decompress);
byte[] output = new byte[uncompressedLength];
size = istream.Read(output, offset, uncompressedLength);

I know this isn't a huge contribution, but hopefully it doesn't make anyone mad if I broke any rules or anything please just let me know politely.

If anyone has or could share the code for classes InstancedObject and InstancedWorldObject I would appreciate it greatly. Of course I'd welcome any technical information on the packet structures too.

Best Wishes,
-Joe

[XTZGZoReX]

I think people are avoiding System.IO.Compression.DeflateStream because of some bug, which naturally, I can't remember what was... Anyhow, you're right - some people don't even know that class exists.

[Ugge]

I think people are avoiding System.IO.Compression.DeflateStream because of some bug, which naturally, I can't remember what was... Anyhow, you're right - some people don't even know that class exists.

Its not a bug. The wow packets that hold compressed data use a zlib stream (RFC 1950) and DeflateStream only implements RFC 1951. Its not supposed to work. However, if you remove the first 2 bytes (the header) of the zlib stream you will in our case get a regular deflate stream (RFC 1951).

In the case of an update packet youd read:
4 bytes: inflated size
2 bytes: zlib header (throw away)
the rest is the deflated stream.

[joe7314]

That explains the extra bytes I was mystified about Thanks!

[XTZGZoReX]

Its not a bug. The wow packets that hold compressed data use a zlib stream (RFC 1950) and DeflateStream only implements RFC 1951. Its not supposed to work. However, if you remove the first 2 bytes (the header) of the zlib stream you will in our case get a regular deflate stream (RFC 1951).

Yeah, that was exactly the thing. I never bothered reading up on it, so didn't know about the RFC compliance - thanks for the clarification.