LZNT1 Decompress

Category: Compression

Status: Registered and callable in the CyberChef 11.3.0 compatibility inventory.

Input / output: byteArray → byteArray

Background: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-xca/5655f4a3-6ba4-489b-959f-e1f407c52f15

What it does

Decompresses data using the LZNT1 algorithm. Similar to the Windows API RtlDecompressBuffer.

Note

Status here means the operation name is implemented and callable. It does not by itself promise byte-for-byte parity for every upstream option. See Compatibility and current status for the verified scope and known boundaries.

Arguments and options

This operation takes no positional recipe arguments.

Recipe template

Important

This is a call template built from the documented defaults. Replace placeholder values such as empty keys, paths, patterns, or lookup data before running it.

from pychef import bake

input_value = b"example"
args = []
result = bake(input_value, ['LZNT1 Decompress'])
print(result)

Pipeline example

from pychef import Pipeline

args = []
transform = Pipeline().then('LZNT1 Decompress')
result = transform(b"example")

Direct call

pychef.ops.run_operation runs any registered operation as a plain function, under the active ExecutionPolicy (safe defaults, no network):

from pychef.ops import run_operation

args = []
result = run_operation('LZNT1 Decompress', b"example", args=args)

Common operations also have typed helpers in Direct operations.

Low-level operation module

Warning

The module below is an internal implementation detail. It applies no execution policy, resource limits, or error sanitization; prefer bake(), Pipeline, or pychef.ops for application code.

The registered entry point lives in pychef.operations.by_operation.lznt1_decompress. Direct calls receive the input value and a positional argument tuple:

from pychef.operations.by_operation.lznt1_decompress import run

result = run(b"example", tuple([]))

pychef.operations.by_operation.lznt1_decompress.run(value, args)

Run this operation using its shared internal implementation.

Parameters:

value (str | bytes)
args (Sequence[Any])

Return type:

str | bytes