{"id":51015048,"url":"https://github.com/securityronin/lzvn","last_synced_at":"2026-06-21T09:02:35.470Z","repository":{"id":365619371,"uuid":"1271849952","full_name":"SecurityRonin/lzvn","owner":"SecurityRonin","description":"Safe, no_std pure-Rust Apple LZVN decompressor — length-tolerant for real macOS decmpfs resource-fork blocks. Published as lzvn-core (lib name lzvn).","archived":false,"fork":false,"pushed_at":"2026-06-18T05:07:21.000Z","size":208,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-18T07:12:29.620Z","etag":null,"topics":["apple","compression","decmpfs","dfir","forensics","lzvn","macos","no-std","rust"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SecurityRonin.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-17T04:20:02.000Z","updated_at":"2026-06-18T05:07:25.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/SecurityRonin/lzvn","commit_stats":null,"previous_names":["securityronin/lzvn"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/SecurityRonin/lzvn","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flzvn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flzvn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flzvn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flzvn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SecurityRonin","download_url":"https://codeload.github.com/SecurityRonin/lzvn/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Flzvn/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34603633,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-21T02:00:05.568Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apple","compression","decmpfs","dfir","forensics","lzvn","macos","no-std","rust"],"created_at":"2026-06-21T09:02:31.915Z","updated_at":"2026-06-21T09:02:35.461Z","avatar_url":"https://github.com/SecurityRonin.png","language":"Rust","funding_links":["https://github.com/sponsors/h4x0r"],"categories":[],"sub_categories":[],"readme":"# lzvn\n\n[![Crates.io](https://img.shields.io/crates/v/lzvn-core.svg)](https://crates.io/crates/lzvn-core)\n[![Docs.rs](https://docs.rs/lzvn/badge.svg)](https://docs.rs/lzvn)\n[![Rust 1.85+](https://img.shields.io/badge/rust-1.85%2B-blue.svg)](https://www.rust-lang.org)\n[![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)\n[![unsafe forbidden](https://img.shields.io/badge/unsafe-forbidden-success.svg)](src/lib.rs)\n[![Sponsor](https://img.shields.io/badge/sponsor-h4x0r-ea4aaa.svg)](https://github.com/sponsors/h4x0r)\n\n**A safe, dependency-free, `no_std` pure-Rust LZVN decompressor that actually reads real macOS files** — length-tolerant where every other Rust decoder rejects them.\n\n```rust\n// A raw Apple LZVN block (small-literal \"hello\" + end-of-stream).\nlet block = [0xe5, b'h', b'e', b'l', b'l', b'o', 0x06, 0, 0, 0, 0, 0, 0, 0];\nlet mut out = [0u8; 5];\nlet n = lzvn::decode_into(\u0026block, \u0026mut out)?;\nassert_eq!(\u0026out[..n], b\"hello\");\n# Ok::\u003c(), lzvn::Error\u003e(())\n```\n\n```toml\n[dependencies]\nlzvn = { package = \"lzvn-core\", version = \"0.1\" }\n```\n\n## Why this exists\n\nLZVN is Apple's compression codec for HFS+/APFS **transparent compression** (`decmpfs` types 7 and 8) and the `bvxn` block type inside an LZFSE stream. Real macOS `decmpfs` resource-fork blocks end with the LZVN end-of-stream opcode (`0x06`) and are then followed by **80–300 bytes of arbitrary trailing data** per block. Apple's kernel and `lzvn_decode_buffer` ignore those bytes; **strict whole-stream Rust decoders (`lzfse_rust`, the `lzvn` crate) reject them** — so they fail on genuine macOS system files (verified against macOS 26.5 \"Tahoe\": 0/25 real type-8 files decoded by the strict path).\n\n`lzvn` stops at the end-of-stream marker and returns. That single property is the difference between decoding a real evidence disk and erroring out.\n\n## Trust, but verify\n\n- **`#![forbid(unsafe_code)]`**, zero dependencies, `no_std` — bounds-checked, returns a typed [`Error`] on malformed input rather than panicking or reading out of bounds.\n- **Validated against an independent oracle.** Committed fixtures are real LZVN streams produced by Apple's own `COMPRESSION_LZVN` encoder (`libcompression`), padded with trailing bytes to mirror a `decmpfs` block — and the decoder was additionally validated against **25 genuine macOS 26.5 system-file blocks** against the same Apple oracle (0/25 decoded by strict decoders, 25/25 here).\n- **Fuzz-hardened.** `cargo fuzz run decode` drives arbitrary input through the decoder; the invariant is \"never panic.\"\n\n## Scope\n\nThis crate is the **codec** — it decodes a raw LZVN block to bytes. The `decmpfs` framing (the resource-fork block table, the inline-marker conventions) belongs to the filesystem reader that calls it (e.g. `hfsplus-forensic`). Decode-only; no encoder.\n\n---\n\n[Privacy Policy](https://securityronin.github.io/lzvn/privacy/) · [Terms of Service](https://securityronin.github.io/lzvn/terms/) · © 2026 Security Ronin Ltd\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Flzvn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecurityronin%2Flzvn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Flzvn/lists"}