VX Heaven

Library Collection Sources Engines Constructors Simulators Utilities Links Forum
[Previous] [Index] [Next]

Benny's Compression Engine for Win32

Author: Benny

Author's comments

let me introduce my second compression engine for Win32 enviroment (u can find my first engine in Win32.Benny and Win98.Milennium). This engine worx on "compressin' bit groups" base. When I started to write this stuff, i wanted to write engine, that would work on Huffmann base. Then I decided it's not needed to implement this complicated algorithm here, coz I wanna be this engine small and effective.

Not only this is truth. This engine is very fast, very small (only 478 bytes) and has implemented my special compression algorithm, that is simple and has very, ehrm, let's call it "interesting" compression ratio X-D.

So how does it work ?

I said, this engine worx on "compressin' bit groups" base. What does it mean ? Bit group (as I call it) is group of two bits. U know, every byte has 8 bits.

Example:       byte 9Ah       group0 group1 group2 group3
               10011010  ===>   10     10     01     10

As u can see, every byte has 4 bit groups and I said, it compresses bit groups. Heh, u think i'm crazy when im tryin' to compress two bits, yeah :?)

This engine will (on the beginnin') calculate, which bit group has the biggest count of repetency, which second biggest, etc...

Example:     group      count
               00  ===>  74
               01  ===>  32
               10  ===>  12
               11  ===>  26

That's not all. It has to sort items to know, which group has the biggest count. I decided it's best to use "bubble sort algorithm". Then there isn't any problem to use "our algorithm".

Look at this table, when in first column r sorted groups and in second comlumn r <another> bits, which will represent new compressed data.

Sorted by count:       1.  ===>  1
                       2.  ===>  00
                       3.  ===>  010
                       4.  ===>  011

Finally, engine will replace bit groups with these bits. Gewd thing on this algorithm is that there aren't needed same bytes to have good compression ratio, but only some bits. So now u know whole secret of my compression algorithm. U also know, why I said, it has "interesting compression ratio". Look at the table and u will see, what type of files can we strongly compress. They r both of binaries and texts, but not every binaries or texts can be compressed as well as otherz. We can compress some binaries again with the same or better ratio. Why ? Imagine, u have file with 1000x 0x0s. After compression we have 125x 0xFFs, that can be compressed again. Some files can be after compression (negative even - file is bigger) compressed again with positive compression (file is smaller). Heh, crazy, isn't it ? X-DDD.

How can I use BCE32 in my virus ?

BCE32 is placed in two procedures called BCE32_Compress and BCE32_Decompress.

  1. BCE32_Compress:

    Input state:

    1. ESI register - pointer to data, which will be compressed
    2. EDI register - pointer to memory, where will be placed compressed data
    3. ECX register - number of bytes to compress + 1 (do not forget "+ 1" !)
    4. EBX register - work memory (16 bytes)
    5. EDX register - work memory (16 bytes). MUST NOT be same as EBX !
    call BCE32_Compress

    Output state:

    1. EAX register - new size of compressed data
    2. CF set, if negative compression
    3. Other registers r preserved (except FLAGS)
  2. BCE32_Decompress: Input state:
    1. ESI register - pointer to compressed data
    2. EDI register - pointer to memory, where will be placed decompressed data
    3. ECX register - number of bytes to decompress (EAX value returned by BCE32_Compress) - 1 (do not forget "- 1" !)
    call BCE32_Decompress

    Output state:

    1. All registers r preserved

WARNING: Be sure, u have enought memory for case of negative compression.

NOTE: U can compress (in some special cases) already compressed data. For this purpose exists output parameters EAX and CF.


bce32.zip3990BCE32May 1999MD5 sum 67c23353e5ad3fb29773f2d144eb98d8

By accessing, viewing, downloading or otherwise using this content you agree to be bound by the Terms of Use! aka