4 ms·
Even if different data are being generated, the compression is still predictable. There must be something in the gzip header indicating the level of compressio
by tsally 17y ago
Even if different data are being generated, the compression is still predictable. There must be something in the gzip header indicating the level of compression (to ensure that the correct decompression algorithm is used). Point being, there's nothing stopping the AV program from figuring out which compressed signature is the correct one. It can even compress the raw signature on the fly.
On your second point I agree. I'll refrain from ranting about AV programs here, but suffice to say there hasn't been enough innovation in the field because AV companies are able to sell substandard products and still make good money.
- dmv 17y agoTo be more specific, compression schemes decode predictably, but any given portion of the compression stream need not be independently predictable. Gzip (and DEFLATE in general) use adaptive compression approaches - the data determines the encoding. If you know your content of interest is in the beginning of the stream, pre-computing different compressions should work out. Otherwise...
- ryanpetrich 17y agoYou've got it backwards: it is the decompression that is predictable; compressors are free to transform the input in any way such that a compliant decompressor will extract the original file. The gzip format documentation is available here btw: http://www.gzip.org/zlib/rfc-gzip.html http://www.gzip.org/zlib/rfc-gzip.html