#!/usr/bin/env python3 """ Experimental KWAJ method-4 (MSZIP/DEFLATE) encoder. Usage: python kwaj4.py inputfile [outputfile] The output uses 32 KiB MSZIP blocks: <"CK">. Each block's size includes the two-byte "CK" marker. A zero-size block ends the stream. IMPORTANT: The supplied Office 4.2 sample's DWORD at header offset 4 is 0xD127F088. Its meaning is not established here, so this encoder preserves that observed value. Validate output with decomp14.exe and libmspack before relying on it for production use. """ import argparse import os import struct import sys import zlib BLOCK_SIZE = 32768 # Header layout observed in the supplied Office 4.2 sample: # "KWAJ", unknown DWORD, method=4, header-size=14, flags=0. SAMPLE_UNKNOWN_DWORD = 0xD127F088 def make_blocks(data): """Return MSZIP blocks with a rolling 32 KiB DEFLATE dictionary.""" result = bytearray() dictionary = b"" for pos in range(0, len(data), BLOCK_SIZE): chunk = data[pos:pos + BLOCK_SIZE] compressor = zlib.compressobj( level=9, method=zlib.DEFLATED, wbits=-15, memLevel=8, strategy=zlib.Z_DEFAULT_STRATEGY, zdict=dictionary if dictionary else b"", ) compressed = compressor.compress(chunk) + compressor.flush() # MSZIP block size counts the CK signature plus compressed bytes. payload = b"CK" + compressed if len(payload) > 0xFFFF: raise ValueError("Compressed MSZIP block exceeds 65535 bytes") result += struct.pack(" {} ({} -> {} bytes)".format( args.input, output, len(data), len(encoded) )) return 0 if __name__ == "__main__": sys.exit(main())