The first two bytes 78 DA are a valid 2 byte zLib header (see section 2.2 on CMF and FLG) that precedes deflate compressed data. So the file could be compressed using zLib/deflate.
For a first quick test, you can use my command-line tool Precomp like this:
precomp -v -c- -slow opr00003.tmp
It will report zLib compressed streams and how big they are decompressed ("... can be decompressed to ... bytes"). If this is successful (returns a decompressed size close to the original filesize you know), use your favourite programming language along with the zLib library to decompress your data.
Also note that if you're lucky, the stream (or a part of it) can be recompressed bit-to-bit identical by Precomp and the output file opr00003.pcf contains (a part of) the decompressed data preceded by a small header.
EDIT: As osgx commented and further analysis showed, the data can not be decompressed using zLib/deflate, so this is still an unsolved case.
EDIT2: The update and especially the linked JS show that it is deflate, but it seems to be some custom variant. Comparison with the original code could help as well as comparison to original zLib source code.
Additionally, the JS code could of course be used to try to decompress the data. It doesn't seem to handle the 2 byte header, though, so perhaps these have to be skipped.
Opera Turbo 缓存中有不同的文件类型。第一个被引用的有问题；一些文件被解压（css 和 js），并且存在 Z 打包的多文件 tar 式图像存档（VP8，通过纯文本 RIFF、WEBP、VP8 魔法检测）：
Z 打包文件头的示例：
5a 03 01 1c 90 02 0a 22 03 18 2a (RIFF data first img) (RIFF data second img)
(RIFF data third img)
RIFF 容器是清晰可见并且有长度字段，所以我建议描述：
5a - magic of format
03 - number of files
01 - first file (riff size=0x1c90)
1c 90 - big-endian len of first file
02 - second file (riff size=0a22)
0a 22 - len of second file
03 - third file (riff size=182a)
18 2a
52 49 46 46 == "RIFF" magic of first file
Another example of Z-file with JPGs ("JFIF" magic isvisible, ffd8ff jpeg-marker is invisible; 8 files inside）：
There are different file types in opera turbo cache. The first one is cited in question; some files are unpacked (css and js), and there is Z-packed multifile tar-like archive for images (VP8, detected by plain-text RIFF,WEBP,VP8 magics):
Example of Z-packed file header:
5a 03 01 1c 90 02 0a 22 03 18 2a (RIFF data first img) (RIFF data second img)
(RIFF data third img)
RIFF container is clearly visible and it has length field, so I suggest a description:
5a - magic of format
03 - number of files
01 - first file (riff size=0x1c90)
1c 90 - big-endian len of first file
02 - second file (riff size=0a22)
0a 22 - len of second file
03 - third file (riff size=182a)
18 2a
52 49 46 46 == "RIFF" magic of first file
Another example of Z-file with JPGs ("JFIF" magic is visible, ffd8ff jpeg-marker is invisible; 8 files inside):
Another detected (by file) type of file is "<000"-file with example header of (hex) "1f 8b 08 00 00 00 00 00 02 ff ec 52 cb 6a c3 30 10 fc 15 63". file says it is "gzip compressed data, max compression", and it is just unpacked by any gzip.
发布评论
评论（2）
前两个字节
78 DA是有效的 2 字节 zLib header（请参阅有关 CMF 和 FLG 的第 2.2 节）位于 压缩压缩数据。因此可以使用 zLib/deflate 来压缩文件。对于第一个快速测试，您可以使用我的命令行工具 Precomp，如下所示：
它将报告 zLib 压缩流以及它们解压缩的大小（“...可以解压缩为...字节”）。如果成功（返回接近您知道的原始文件大小的解压缩大小），请使用您最喜欢的编程语言以及 zLib 库 解压缩您的数据。
另请注意，如果幸运的话，流（或其一部分）可以通过 Precomp 进行逐位重新压缩，并且输出文件
opr00003.pcf包含（一部分）解压缩的数据前面有一个小标头。编辑：正如 osgx 评论和进一步分析所示，数据不能使用 zLib/deflate 解压缩，因此这仍然是一个未解决的情况。
EDIT2：更新，尤其是 链接的 JS 表明它<是放气的，但它似乎是一些自定义变体。与原始代码进行比较可能会有所帮助以及比较原始 zLib 源代码。
此外，JS 代码当然可以用于尝试解压缩数据。不过，它似乎无法处理 2 字节标头，因此也许必须跳过这些标头。
The first two bytes
78 DAare a valid 2 byte zLib header (see section 2.2 on CMF and FLG) that precedes deflate compressed data. So the file could be compressed using zLib/deflate.For a first quick test, you can use my command-line tool Precomp like this:
It will report zLib compressed streams and how big they are decompressed ("... can be decompressed to ... bytes"). If this is successful (returns a decompressed size close to the original filesize you know), use your favourite programming language along with the zLib library to decompress your data.
Also note that if you're lucky, the stream (or a part of it) can be recompressed bit-to-bit identical by Precomp and the output file
opr00003.pcfcontains (a part of) the decompressed data preceded by a small header.EDIT: As osgx commented and further analysis showed, the data can not be decompressed using zLib/deflate, so this is still an unsolved case.
EDIT2: The update and especially the linked JS show that it is deflate, but it seems to be some custom variant. Comparison with the original code could help as well as comparison to original zLib source code.
Additionally, the JS code could of course be used to try to decompress the data. It doesn't seem to handle the 2 byte header, though, so perhaps these have to be skipped.
Opera Turbo 缓存中有不同的文件类型。第一个被引用的有问题；一些文件被解压（css 和 js），并且存在 Z 打包的多文件 tar 式图像存档（VP8，通过纯文本 RIFF、WEBP、VP8 魔法检测）：
Z 打包文件头的示例：
RIFF 容器是清晰可见并且有长度字段，所以我建议描述：
Another example of Z-file with JPGs ("JFIF" magic isvisible, ffd8ff jpeg-marker is invisible; 8 files inside）：
另一个检测到的（由
file）文件类型是“<000”-文件的示例标头为（十六进制）“1f 8b 08 00 00 00 00 00 02 ff ec 52 cb 6a c3 30 10 FC 15 63 英寸。file表示它是“gzip 压缩数据，最大压缩”，并且它只是被任何 gzip 解压。There are different file types in opera turbo cache. The first one is cited in question; some files are unpacked (css and js), and there is Z-packed multifile tar-like archive for images (VP8, detected by plain-text RIFF,WEBP,VP8 magics):
Example of Z-packed file header:
RIFF container is clearly visible and it has length field, so I suggest a description:
Another example of Z-file with JPGs ("JFIF" magic is visible, ffd8ff jpeg-marker is invisible; 8 files inside):
Another detected (by
file) type of file is "<000"-file with example header of (hex) "1f 8b 08 00 00 00 00 00 02 ff ec 52 cb 6a c3 30 10 fc 15 63".filesays it is "gzip compressed data, max compression", and it is just unpacked by any gzip.