Windows can't recognize compression, show overlay image on file icon in this case and decompress files with menu.
Total Commander have option to search compressed files, but it not works with this parameter.
Is there any way to search ? Plugins, options, scripts...?
- Site Admin
- Posts: 36680
- Joined: 2003-02-04, 09:46 UTC
- Location: Switzerland
TC should show "c" character in "Attributes" column for NTFS-compressed files. You can also find them via the second tab of the search page.
It works with standard compression.
But my question - about NTFS-compression with parameter /exe in Windows 10, for example
Code: Select all
compact /c /a /f /i /exe:xpress16k /s:"d:\MyDirectory"
In Windows file properties "Size" and "Size on disk" are diferent.
TC command cm_GetFileSpace show incorrect "Actual space used on source drive".
But maybe some tricks exist...
How would you detect such files? (binary signatures, Header Hexdump, magic numbers)
As I understand, this 'brand new compression' doesn't change files itself, it only stores them in a new special compressed form that provides better compression for PE files. And it seems that it uses some other file attributes than reqular NTFS compressed files use (C attribute flag), and this is quite strange for me.
It's not "brand new", /exe switch is just for internal executable compression, now incorporated into the program for NTFS compression, see https://en.wikipedia.org/wiki/Executable_compression
The options meaning:
- lzx - LZ compression like old DOS LZEXE packer, see https://bellard.org/lzexe.html
- express4k, express8k, express16k - LZMA compression like UPX and other modern exe packers, 4k, 8k, 16k - is block size or alignment.
If it's full exe packer, every compacted executable (exe, dll etc.) should start with unpacking stub containing its unique signature (as @Stefan2 suggests). In this case there won't be "c" NTFS attribute, and TC should always show compressed size.
Maybe Total7zip plugin with additional codecs will show uncompressed size, when pressing Ctrl+PgDn to open archive…
I may be wrong, didn't test yet.
Andrzej P. Wozniak
But compact.exe IS exe packer when called with /exe switch. And now I'm sure that decompression module cannot be added as a stub to exe. I've forgotten that executable files are digitally signed with certificate so they cannot be changed. That's why decompression must be transparent.
It looks like I'm wrong about LZX algorithm - it's probably LZMA compression of the whole file, while express compression works on the fly with smaller LZMA compressed data blocks. Unfortunately, the article doesn't explain the whole thing.
If it's done on the system level, the NTFS driver must somehow recognize execompressed files so there should be some additional attribute in MFT. I know that MS coders can make it completely dumb and the NTFS driver may work like old doublspace/drivespace now checking every cluster for compression signature, but it would be really stupid. There may also be problems with defragmentation, so there should be some API dealing with new compression methods…
Andrzej P. Wozniak
It is not an exe packer in usual meaning, because it has no a stub that decompresses payload into memory, it is file system driver who decompresses original file before mapping it onto the memory.But compact.exe IS exe packer when called with /exe switch.
It's possible that you should first create partition and format it under newest Win10 build. It may be newer NTFS version marked somewhere there… Guessing only…
You are talking about two things - packer and unpacker. There's no need to keep both features in a single file. Remember old pkzip/pkunzip separate files?
To be honest, I don't know (and don't want to guess any more here) whether exe pack/unpack libs are separate dlls or modules linked statically here or there. That's why I've mentioned lack of documentation.
Andrzej P. Wozniak
Usually EXE packers that modify binaries and leave EXE extension produce "self-extracting archives" that unpack and call compressed binaries when you execute them on the fly. Otherwise compressed files would have another extension.You are talking about two things - packer and unpacker. There's no need to keep both features in a single file. Remember old pkzip/pkunzip separate files?