4 ms·
The article says that WinRAR "displays both ZIP structures", so, no, it doesn't do it right. Of the three, only Windows Explorer is close to the correct behavi
by cxr 2y ago
The article says that WinRAR "displays both ZIP structures", so, no, it doesn't do it right. Of the three, only Windows Explorer is close to the correct behavior (showing the contents of the ZIP that was appended closest to the end, and ignoring everything else). The exception to its correctness is that they report it may fail to process the ZIP and identify it as being corrupt, which shouldn't happen so long as the endmost ZIP is well-formed.
- nh2 2y ago> The article says that WinRAR "displays both ZIP structures", so, no, it doesn't do it right. That would be true, but the bleepingcomputer article seems to be misquoting that fact. The original research they reference (which I also find to be a more sensible article), https://perception-point.io/blog/evasive-concatenated-zip-trojan-targets-windows-users/ https://perception-point.io/blog/evasive-concatenated-zip-tr... says that WinRAR only shows they last archive contents, and shows a screenshot of that: > WinRAR, on the other hand, reads the second central directory and displays the contents of the second archive
- cxr 2y agoThanks, that's a much better article (and published on a site that, while slightly annoying on its own, is infested with fewer rudely intrusive and resource-consuming ads). Reading both, it's clear that (a) you are correct, and (b) the submitted link, besides being materially inaccurate, is shameless reblog spam and should be changed.