cybersecurity · beginner · ~15 min · safe pentest lab

Is it gzip-compressed?

Recognise the gzip magic.

Challenge

Detect a gzip-compressed blob from its magic bytes — firmware images are often gzip-wrapped and must be decompressed first.

Task

Implement int is_gzip(const unsigned char *b) that returns 1 if the first two bytes are the gzip magic 0x1F 0x8B, else 0.

Input

  • b: a byte buffer of at least 2 bytes. The grader passes a fixed buffer.

Output

Returns int: 1 if b[0] == 0x1F && b[1] == 0x8B, else 0.

Example

b = 0x1F 0x8B 0x08   ->   is_gzip(b) -> 1
b = 0x50 0x4B        ->   is_gzip(b) -> 0   (that is ZIP)

Edge cases

  • Only the first two bytes matter.

Input format

A byte buffer b of at least 2 bytes.

Output format

An int: 1 if the first two bytes are 0x1F 0x8B, else 0.

Constraints

gzip magic is 0x1F 0x8B.

Starter code

int is_gzip(const unsigned char *b) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.