How to decompress CWS files?

[LCF-AT]

Hi guys,

does anyone know how to decompress CWS files to FWS (decompressed) manually or via dll / API xy?

My first goal was it to find any internet request paramter what could do decompress directly on fly but I didnt found such command and can only download the CWS file.Now I got this in memory and would like to decompress it now before writing the file.Next I tried to find any way to do this manually but also didnt find a description how to decompress CWS by hand.As next I tried to find any dll / APIs which I could use to decompress the CWS / bytes in memory and just found infos about zlib but also there I found no infos about CWS etc.Now the question is how to do this now?Does anyone have any helpfully infos about that (manually if its not to much)?Or if I can use a dll / API xy for this so what dll I need & which function of it I have to use for it?

I also found a tool called SWF ID what also can unpack such files but I could not find out how it does decompress the file.Maybe there are used any same byte pattern for this or something etc so I dont know it yet.

Would be nice if anyone could help me again a little.

Thank you

[NOP]

CWS / FWS is compressed / uncompressed SWF files isn't it?

I dont have any api but there's a free utility to do what you want which uses zlib 1.1.4 compression/decompression...

CLICKY

EDIT: I have used C# to decompress CWS to FWS...

strSignature = "CWS";
strmReader.ReadByte();
strmReader.ReadByte();
DeflateStream zipStream = new DeflateStream(strmReader, CompressionMode.Decompress);
strmReader = zipStream;

then read the tags and data blocks until end of stream

Edited December 9, 2016 by NOP

[kao]

Any decent tool that handles Flash files can deal with both compressed and uncompressed files. So, I can't see any reason why convert file before saving to disk.

If you still want to do it, CWS file (except first 8 bytes) is compressed using very standard Zlib compression. For details, see SWF File Format Specification on Adobe site.

[SkyProud]

https://github.com/zefonseca/cws2fws/blob/master/cws2fws

Does this Perl script help?

Edited December 10, 2016 by SkyProud
Fix typo.

[skypeaful]

Old .c program cws2swf (binary include source): http://iancoog.altervista.org/C/cws2fws.rar

[LCF-AT]

Hi guys,

thanks for your answers so far.So I see the tools you did post are also using zlib as lib inside the tools itself.I have also any zlib lib for MASM pointed from kao before a while and I would like to use this lib too (or dll + function) to decompress the CWS in memory.I did check again the internet to find any function to do this also on site of zlib and a function called uncompress what should do this...

PROTO Source_Buffer:DWORD,Source_Len:DWORD,Dest_Buffer:DWORD,Dest_Len:DWORD

...but it makes trouble so it does not handle the header of CWS files and I get Z_DATA_ERROR back.The question is how to get it work?First 8 bytes are the header datas of CWS (Sig / version / lenght) and the rest should be the normal compressed code.I think I need to fake the header data so that the API does accept it to decompress the code but I dont know the header of compressed zlib / gzip etc what it only accept or so.

The tool swfdecomp can decompress the CWS file but I cant debug the whole file / lib functions to see what it does completely.

So what I need to mod at header etc to get the uncompressed function working?Just need any tiny example etc.

Thank you

[LCF-AT]

Hi again,

ok I got something working now...

int uncompress(Bytef * dest, uLongf * destLen, const Bytef * source, uLong sourceLen);

		    mov eax, FILESIZE
		    imul eax,4	
		    mov DESTLEN, eax	   
		    invoke VirtualAlloc,NULL,eax,MEM_COMMIT,PAGE_EXECUTE_READWRITE
		    mov DEST, eax

		    sub FILESIZE,8 ; Header
		    add SOURCE,8   ; Header
		    
            lea eax, FILESIZE ; pointer
		    push eax
		    push SOURCE
		    lea eax, DESTLEN ; pointer
		    push eax
		    push DEST		    
		    call uncompress_API

....seems that uLongf *destLen & uLong sourceLen means I have to use pointer address where sizes are stored.Ok so I get the fle now decompressed with that uncompress API (I use dll / API at the moment for testing) what is good so far.Now I got a new little problem.So I would like to use the zlib lib I have for masm zlibstat.inc & zlibstat128.lib but if I try to decompile the file I get error message about uuid.lib which I dont have and also find nothing to download of course.

Does anyone have this uuid.lib for masm?Or does it mean I have to build a new own lib for this zlib1.dll I have?I also dont remember anymore how to build a lib.

greetz

[LCF-AT]

Hi again,

short info.So I did it so far. I did build a new lib file I can use now without that uulib trash etc.Everything seems to work fine now and I got all infos out of the CWS / FWS I was looking for on fly but it was again a hard birth. Will see how it works if I add this part into my app later.

Thanks again so far guys.

[Matrix==0]

On 12/11/2016 at 1:56 AM, LCF-AT said:

   HELLO ALL     LCF-AT    CAN YOU  HELP ME TO DECOMPRESS A CWS  I HAVE SAME PROBLEM I AM SUCCESSFUL TO DECOMPRESS ONE  CWS BUT ONLY IN PARTLY NOT EVERYTHING .WHAT I NEED DO ??

 

Edited August 23, 2018 by Matrix==0

[Matrix==0]

2 minutes ago, Matrix==0 said:

 

Edited August 23, 2018 by Matrix==0

[LCF-AT]

Hi,

do you use zlib1.lib?Whats error code get you back?I dont find the header file of it at the moment to check what error xy means if you get any of them.Maybe you did alloc too less size for the decompress process.I use filesize of swf * 8.

mov eax, FILESIZE ; swf
imul eax, 8
mov DESTLEN, eax
invoke VirtualAlloc,NULL,eax,MEM_COMMIT,PAGE_EXECUTE_READWRITE
mov DEST, eax
sub FILESIZE,8
add SOURCE,8   ; SOURCE = SWF of MapViewOfFile
invoke uncompress,DEST,addr DESTLEN,SOURCE,addr FILESIZE
...etc

The header of CWS I have to copy to new buffer and change C to F if you need to dump it etc.

greetz