http compression/decompression

[Frederik Vanderhaegen]

Hi,

I'm writing an application who captures everything that passes on port 80.
The result op the capture is an byte array with the retrieved values.
My problem is the following when i'm trying to convert the byte array to
UTF8 everything looks like:

"E §EQ@ @q¦À¨
ˬ

=ryQz³aôóPþ&Iá À×±´¤0f²û -quGXzÚìsRâë'¦V0L¡²"#Ä´5ç\}?P>ã
!(?§ÃlnÞ0^YÑöOßS?Tµw·ö¾î?i¼`
d.SwìÓ'øz+ì^®á§
MS~´"2¨/<"Ü5ã'f`t¢k5ÁhÊÚÁ×Z¼Y"¡¥é<ÿTµAÙ¼¼x7¬Ã§lsö­æL§kÕ.§Á^Ø/?
°M&h;gû¹hÏG)Âïoü÷0£]j?AFEÊ 9 Á=ù°x¡ø [²bÇ«ÅÀÝëÃ5=Di¢çJ'Z¨nGzâ¾ákN-üo$-AÓì°aÛmXú²-SSºîÇï»jHôÆÈ£?-rÌt>|ô:va)À¶­fÝ--I¾ñf;ï\:F-4õôY¿Á6³úK^L?}{d­Dû~&D?'í¦,#4%SÂ
á>8,"Ú'ú&SL¾¹MYú½.N"!ÿÔ\ñxO.ºì\c÷ZYÄmÉá.
ÉP<FàD>(ý Ñúð?_?r±àôæâ&Énc¸ýhSY×8 Éûe6ít-3é|?yø{%,ѨT#"
Ǻ{/é¸.®kDÇ?r>ò¸¬i?"+¼zù3{îSÃoæwõZÄ
M`íH")n'@Y÷˹Xx?L®ªP¨e1]®¼|ñÕ
Y³èÌ¿ò½6ÒÐaX³kì<f2k\ûv×{ñîþ¢×:ö'0¯û.>sKíu$'?dÝ"$X²³'gªyo'ì:+!kõ8Ê.×piÉ#>BÁ'
yÀKWGû&Õ?ùfs,ZìOÝ
¯8IjÓó4qLpTÑÝÕ)3äþðs2ýDfÙ.óìÃ1-.ê§î½´'®E$·3ø]4FÐí?¦ͬèeO¼S Ý L*{
¡ËFÐðNÓÖíæ¼só'¨ à¸"lb½DYr.²,Ã^."

I've read somewhere that current browsers sometimes use "content-encoding:
gzip,deflate".
So I think this is also the case in the above sample (which is the first
packet I receive when I surf to www.google.be) , only I can't decompress the
packets who are sent over port 80, I'm using SharpZipLib and receive errors
like "first byte is incorrect, ..."

Does anyone has an idea/solution for my problem?

Thx in advance

Frederik

 

[=?windows-1252?Q?Arne_Vajh=F8j?=]

I'm writing an application who captures everything that passes on port 80.
The result op the capture is an byte array with the retrieved values.
My problem is the following when i'm trying to convert the byte array to
UTF8 everything looks like:

"E §EQ@ @q¦À¨
ˬ

=ryQz³aôóPþ&Iá À×±´¤0f²û -quGXzÚìsRâë'¦V0L¡²"#Ä´5ç\}?P>ã
!(?§ÃlnÞ0^YÑöOßS?Tµw·ö¾î?i¼`

I've read somewhere that current browsers sometimes use "content-encoding:
gzip,deflate".
So I think this is also the case in the above sample (which is the first
packet I receive when I surf to www.google.be) , only I can't decompress the
packets who are sent over port 80, I'm using SharpZipLib and receive errors
like "first byte is incorrect, ..."

Does anyone has an idea/solution for my problem?

You could try GZIP deflate it !

..NET 2.0 has GZIP support in System.IO.Compression ...

Arne

 

[Frederik Vanderhaegen]

Hi,

I've tried it with GZIP from .NET 2.0 but got following error:
"The magic number in GZip header is not correct. Make sure you are passing
in a GZip stream."
I checked the message with Hexview and saw that the gzip header was missing.
After adding that,
I tried it again but then got "Found invalid data while decoding".

Decompressing the byte array, captured through port 80, seems not be as easy
as I thought.

Does anyone have any idea about the structure of a http message or about how
to decompress such a message?

Frederik