7 ms·
> How do you read a zip file? > This is undefined by the spec. > There are 2 obvious ways. > 1. Scan from the front, when you see an id for a record do the a
by yakubin 5y ago
> How do you read a zip file?
> This is undefined by the spec.
> There are 2 obvious ways.
> 1. Scan from the front, when you see an id for a record do the appropriate thing.
> 2. Scan from the back, find the end-of-central-directory-record and then use it to read through the central directory, only looking at things the central directory references.
I was recently bitten by this at work. I got a zip from someone and couldn't find inside the files that were supposed to be there. I asked a colleague, and they sent me a screenshot showing that the files were there, and that they didn't see the set of files that I saw. I listed the content of the zip using the "unzip -l" command. They used the engrampa GUI. At that point I looked at the hexdump of the file. What caught my eye was that I saw the zip magic number near the end of the zip, which was odd. The magic number was also present at the beginning of the file. At this point I suspected that someone used cat(1) to concatenate two zips together. I checked it with dd(1), extracting the sequence of bytes before the second occurrence of the zip magic number and the remainder into two separate files. And sure enough at that point both "unzip -l" and "engrampa" showed the same set of files, and both could show both zips correctly. Turns out engrampa was reading the file forwards, whereas unzip was reading the file backwards.
- fendy3002 5y agoThe fact that merging zip files with cat and do not produce error is amazing by itself. Now we'll wait until someone find / use a way to distribute hidden files using this method.
- cesarb 5y ago> Now we'll wait until someone find / use a way to distribute hidden files using this method. You mean like the GIFAR attack (https://en.wikipedia.org/wiki/GIFAR https://en.wikipedia.org/wiki/GIFAR)?
- deleted 5y ago[deleted]
- j16sdiz 5y agoThis is what the original SFX self-executable extractor use. Appends a zip file to a extractor exe. This is also why traditionally zip are read from backwards.
- yoru-sulfur 5y agoWhat will really blow your mind is that you can cat a png and a zip together and the resulting file is both a valid png that looks identical to the image and a zip that contains the same contents as the archive.
- Clewza313 5y agoMind. Blown. Only works if the PNG is first and the ZIP second though, because PNG reads front to back and ZIP reads back to front.
- tinus_hn 5y agoThis is how these self extracting archives work, it’s just an exe (that allows adding random data to the end) and a zip (that allows random data to be prepended) added together.
- edub 5y agomore specifically the executable part contains the logic to decompress the remainder of the file, while still allowing a decompression program to be able to open and decompress the file (ignoring the executable portion of that file).
- mike_d 5y agoYou might enjoy PoC||GTFO issue #10: > The polyglot file pocorgtfo10.pdf is valid as a PDF, as a ZIP file, and as an LSMV recording of a Tool Assisted Speedrun (TAS) that exploits Pokémon Red in a Super GameBoy on a Super NES. The result of the exploit is a chat room that plays the text of PoCkGTFO 10:3. https://www.alchemistowl.org/pocorgtfo/pocorgtfo10.pdf https://www.alchemistowl.org/pocorgtfo/pocorgtfo10.pdf
- achairapart 5y agoThis may be also the trick used by the fantasy console PICO-8[0] which games run by png-based cartridges[1]. [0]: https://www.lexaloffle.com/pico-8.php https://www.lexaloffle.com/pico-8.php [1]: https://www.lexaloffle.com/bbs/?cat=7&carts_tab=1#sub=2&mode=carts&orderby=featured https://www.lexaloffle.com/bbs/?cat=7&carts_tab=1#sub=2&mode...
- thrashh 5y agoA lot of software installers use this method. It’s a very old tried and true method.
- seisvelas 5y agoBack in the day people used to spread zips hidden in jpegs on imageboards using basically the same idea (after the jpg data is the zip data) The most iconic /i/ kit spread this way being Dangerous Kitten (https://web.archive.org/web/20120322025258/http://partyvan.info/wiki/Dangerous_Kitten https://web.archive.org/web/20120322025258/http://partyvan.i...)
- otabdeveloper4 5y ago> Now we'll wait until someone find / use a way to distribute hidden files using this method. No need to wait. Microsoft does this in their file formats. (E.g., PowerBI's pbix files have this pattern.)
- dirkt 5y agoYou may enjoy the PoC || GTFO ("Proof of Concept or Get The Fuck Out", google) "newsletter", which is a pdf and zip in a single file, sometimes with a some other file types merged in, too (e.g. truecrypt), and which also contains back issues in the current issue, russian-doll-style.
- Dylan16807 5y ago> Turns out engrampa was reading the file forwards, whereas unzip was reading the file backwards. Was the second zip less than 64KB in size? If not then engrampa was being extra wrong about looking for the header.
- yakubin 5y agoThe second zip had 109 bytes.
- weird-eye-issue 5y agoI can think of some scenarios where that could really cause some harm
- swiley 5y agoAPK files are zips, although the same code that reads them probably checks signatures.
- Karliss 5y agoThere was at least one or two vulnerabilities in Android because it wasn't the same code doing those two things. Later they added a signature for whole zip(almost*) instead of previous approach inherited from jar which hashed each file inside the zip individually. That way signature check doesn't need to parse zip headers*. * Since the signature is put somewhwere between zip headers instead of separate file there needs to be little bit of parsing to locate it and the hash isn't straight forward hash of whole file because it needs to exclude the signature part. edit: turns out they later also added a version of external signature
- formerly_proven 5y agoIntermingling signatures or authentication and data layout is such a common failure and people do it over and over again, even in relatively new projects like Android. I wonder why the initial design took off? This is something were I would expect any crypto engineer to refuse to sign the design off, because it is going to break; it's not even a question. If you do anything other than Sign(Blob) and later Verify(Signature, Blob) && Parse(Blob) you're going to do it wrong.
- m4rtink 5y agoNot just APK, EPUB (ebook file format) as well, likely many others as well (IIRC JAR for Java ?).
- scosman 5y agoSuper helpful for streaming though -- don't need to know all file sizes upfront.
- hypertele-Xii 5y agoI've seen legitimate uses of this feature where an executable appends a zip file onto itself, and can then access this portable, compressed storage at runtime.
- web007 5y agoYou got an invalid ZIP file, so behavior is inherently undefined. Per the blog + spec: A ZIP file MUST have only one "end of central directory record".