ntcompress.ntdll¶

`ntcompress.ntdll` ¶

ntdll.dll RtlCompressBuffer / RtlDecompressBuffer compression formats.

Provides both Shape A (enum dispatch) and Shape B (direct module import) APIs for every raw stream compression format exposed by Windows ntdll.dll. The Format enum values are the actual CompressionFormatAndEngine constants from ntifs.h (values 0x0002--0x0008).

Shape A (enum dispatch)::

import ntcompress.ntdll
compressed = ntcompress.ntdll.compress(data, ntcompress.ntdll.Format.LZNT1)
plain = ntcompress.ntdll.decompress(compressed, ntcompress.ntdll.Format.LZNT1)

Shape B (direct module)::

from ntcompress.ntdll import lznt1
compressed = lznt1.compress(data)
plain = lznt1.decompress(compressed)

`COMPRESSION_FORMAT_LZNT1 = Format.LZNT1` `module-attribute` ¶

Alias for Format.LZNT1 (0x0002), matching the ntifs.h constant name.

`COMPRESSION_FORMAT_XPRESS = Format.XPRESS` `module-attribute` ¶

Alias for Format.XPRESS (0x0003), matching the ntifs.h constant name.

`COMPRESSION_FORMAT_XPRESS_HUFF = Format.XPRESS_HUFF` `module-attribute` ¶

Alias for Format.XPRESS_HUFF (0x0004), matching the ntifs.h constant name.

`Format` ¶

Bases: IntEnum

Compression format identifiers for ntdll.dll RtlCompressBuffer/RtlDecompressBuffer.

Values 0x0002--0x0008 are the CompressionFormatAndEngine base-format constants from ntifs.h. Not all formats are available on all Windows builds; see the per-member docstrings for minimum build numbers.

`LZNT1 = 2` `class-attribute` `instance-attribute` ¶

COMPRESSION_FORMAT_LZNT1 -- chunk-based LZ77 ([MS-XCA] §2.5). XP+.

`XPRESS = 3` `class-attribute` `instance-attribute` ¶

COMPRESSION_FORMAT_XPRESS -- Plain LZ77 ([MS-XCA] §2.1). Win8.1+.

`XPRESS_HUFF = 4` `class-attribute` `instance-attribute` ¶

COMPRESSION_FORMAT_XPRESS_HUFF -- LZ77+Huffman ([MS-XCA] §2.2). Win8.1+.

`XPRESS9 = 5` `class-attribute` `instance-attribute` ¶

Compact XPRESS9 -- canonical Huffman LZ77, magic 0xC039E510. Server 2022+ (Build 20348+).

`XP10 = 6` `class-attribute` `instance-attribute` ¶

XP10 -- raw LZ4 block format. Win11 / Server 2025 (Build 26100+).

`DEFLATE = 7` `class-attribute` `instance-attribute` ¶

Raw DEFLATE (RFC 1951, wbits=-15). Win11 / Server 2025 (Build 26100+).

`ZLIB = 8` `class-attribute` `instance-attribute` ¶

ZLIB wrapper (RFC 1950, wbits=15). Win11 / Server 2025 (Build 26100+).

`compress(data: Buffer, fmt: Format) -> bytes` ¶

Compress plaintext using the specified ntdll format.

Dispatches to the per-format compress() function.

Parameters:

Name	Type	Description	Default
`data`	`Buffer`	The plaintext to compress.	required
`fmt`	`Format`	The compression format to use.	required

Returns:

Type	Description
`bytes`	The compressed stream.

Raises:

Type	Description
`FormatUnavailableError`	No codec is registered for the format.

`decompress(blob: Buffer, fmt: Format) -> bytes` ¶

Decompress a raw stream using the specified ntdll format.

Unlike ESE dispatch, there is no auto-detection -- raw ntdll streams carry no format header, so the caller must specify which format was used.

Parameters:

Name	Type	Description	Default
`blob`	`Buffer`	The compressed stream.	required
`fmt`	`Format`	The compression format that was used to produce the stream.	required

Returns:

Type	Description
`bytes`	The decompressed plaintext.

Raises:

Type	Description
`FormatUnavailableError`	No codec is registered for the format.

ntcompress.ntdll¶