ntcompress.ntdll¶

`ntcompress.ntdll` ¶

ntdll.dll RtlCompressBuffer / RtlDecompressBuffer compression formats.

Provides both Shape A (enum dispatch) and Shape B (direct module import) APIs for every raw stream compression format exposed by Windows ntdll.dll. The Format enum values are the actual COMPRESSION_FORMAT_* constants from ntifs.h (values 0x0002--0x0004), plus library extensions for related MS-XCA codecs at 0x0100+.

Shape A (enum dispatch)::

import ntcompress.ntdll
compressed = ntcompress.ntdll.compress(data, ntcompress.ntdll.Format.LZNT1)
plain = ntcompress.ntdll.decompress(compressed, ntcompress.ntdll.Format.LZNT1)

Shape B (direct module)::

from ntcompress.ntdll import lznt1
compressed = lznt1.compress(data)
plain = lznt1.decompress(compressed)

`COMPRESSION_FORMAT_LZNT1 = Format.LZNT1` `module-attribute` ¶

Alias for Format.LZNT1 (0x0002), matching the ntifs.h constant name.

`COMPRESSION_FORMAT_XPRESS = Format.XPRESS` `module-attribute` ¶

Alias for Format.XPRESS (0x0003), matching the ntifs.h constant name.

`COMPRESSION_FORMAT_XPRESS_HUFF = Format.XPRESS_HUFF` `module-attribute` ¶

Alias for Format.XPRESS_HUFF (0x0004), matching the ntifs.h constant name.

`Format` ¶

Bases: IntEnum

Compression format identifiers for ntdll.dll RtlCompressBuffer/RtlDecompressBuffer.

Values 0x0002--0x0004 are the COMPRESSION_FORMAT_* constants from ntifs.h. Values 0x0100+ are library extensions for related MS-XCA codecs not exposed through the RtlCompressBuffer API.

`LZNT1 = 2` `class-attribute` `instance-attribute` ¶

COMPRESSION_FORMAT_LZNT1 -- chunk-based LZ77 ([MS-XCA] §2.5).

`XPRESS = 3` `class-attribute` `instance-attribute` ¶

COMPRESSION_FORMAT_XPRESS -- Plain LZ77 ([MS-XCA] §2.1).

`XPRESS_HUFF = 4` `class-attribute` `instance-attribute` ¶

COMPRESSION_FORMAT_XPRESS_HUFF -- LZ77+Huffman ([MS-XCA] §2.2).

`DEFLATE = 256` `class-attribute` `instance-attribute` ¶

Extension -- raw DEFLATE (RFC 1951). Not a Windows constant.

`ZLIB = 257` `class-attribute` `instance-attribute` ¶

Extension -- ZLIB wrapper (RFC 1950). Not a Windows constant.

`compress(data: Buffer, fmt: Format) -> bytes` ¶

Compress plaintext using the specified ntdll format.

Dispatches to the per-format compress() function.

Parameters:

Name	Type	Description	Default
`data`	`Buffer`	The plaintext to compress.	required
`fmt`	`Format`	The compression format to use.	required

Returns:

Type	Description
`bytes`	The compressed stream.

Raises:

Type	Description
`FormatUnavailableError`	No codec is registered for the format.

`decompress(blob: Buffer, fmt: Format) -> bytes` ¶

Decompress a raw stream using the specified ntdll format.

Unlike ESE dispatch, there is no auto-detection -- raw ntdll streams carry no format header, so the caller must specify which format was used.

Parameters:

Name	Type	Description	Default
`blob`	`Buffer`	The compressed stream.	required
`fmt`	`Format`	The compression format that was used to produce the stream.	required

Returns:

Type	Description
`bytes`	The decompressed plaintext.

Raises:

Type	Description
`FormatUnavailableError`	No codec is registered for the format.

ntcompress.ntdll¶