{
  "slug": "lznt1-decompress",
  "name": "gizza-ai/lznt1-decompress",
  "version": "0.1.0",
  "title": "LZNT1 Decompress — Decode RtlCompressBuffer Blobs — gizza.ai",
  "description": "Decompress LZNT1 (Windows RtlCompressBuffer) blobs from hex or Base64 in your browser — registry hives, hiberfil, malware configs. Free, private, no sign-up.",
  "tags": [
    "lznt1",
    "lznt1 decompress",
    "rtldecompressbuffer",
    "rtlcompressbuffer",
    "ntfs compression",
    "registry hive",
    "hibernation file",
    "malware analysis",
    "forensics",
    "compression_format_lznt1"
  ],
  "category": "security",
  "urls": {
    "page": "https://gizza.ai/tools/lznt1-decompress/",
    "markdown": "https://gizza.ai/tools/lznt1-decompress/index.md",
    "descriptor": "https://gizza.ai/tools/lznt1-decompress/tool.json",
    "deep_link_example": "https://gizza.ai/tools/lznt1-decompress/?data=Paste%20the%20compressed%20blob%20as%20hex%20%28e.g.%2003b0%200041%204243%29%20or%20Base64&input_encoding=hex&output_encoding=hex"
  },
  "cli": "gizza tool lznt1-decompress \"Paste the compressed blob as hex (e.g. 03b0 0041 4243) or Base64\"",
  "tool": {
    "description": "Decompress an LZNT1 blob — the legacy compression format produced by Windows RtlCompressBuffer / RtlDecompressBuffer with COMPRESSION_FORMAT_LZNT1, used in NTFS compressed files, registry hives, hibernation files, and many malware configuration blobs. Provide the compressed bytes in 'data' as hex (default) or base64 via input_encoding, and choose output_encoding='hex' (default, binary-safe), 'text' (UTF-8), or 'base64' to view the recovered original data. Pure decoder of the chunk/flag-group/back-reference wire format; no host calls.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "data": {
          "description": "The LZNT1-compressed blob, encoded per input_encoding (hex or base64). This is the raw output of Windows RtlCompressBuffer with COMPRESSION_FORMAT_LZNT1 — e.g. a compressed registry-hive cell, hibernation-file page, or malware config.",
          "type": "string"
        },
        "input_encoding": {
          "default": "hex",
          "description": "How the compressed blob in 'data' is encoded: 'hex' (default; whitespace and a 0x prefix are ignored) or 'base64'.",
          "enum": [
            "hex",
            "base64"
          ],
          "type": "string"
        },
        "output_encoding": {
          "default": "hex",
          "description": "How to render the decompressed bytes: 'hex' (default; safe for binary), 'text' (UTF-8 — errors if the output isn't valid UTF-8), or 'base64'.",
          "enum": [
            "hex",
            "text",
            "base64"
          ],
          "type": "string"
        }
      },
      "required": [
        "data"
      ],
      "type": "object"
    }
  }
}