ZIP

V*V

an archive walkthrough

Dissected:file

Ange:Albertini corkamiucom

Hexadecimal:dump

ASCII:dump

(:tkBt:wt:kt:At::t::t::t::t::t::t::t::t::tDDtDDttPKzzzzzzzzzzzzzz

~$ unzip simple.zip Archive: simple.zip extracting: hello.txt ~$ cat hello.txt Hello World!

W

bktODt:Dt::t::t::t:Dt::t::t::t::t::t::t::ttttttttz}zzzzzzzzzzzz

Local:file:Header

(:tkBt:wt:kt:At::t::t::t::t::t::t::t::t::tDDtDDttPKzzzzzzzzzzzzzz bktODt:Dt::t::t::t:Dt::t::t::t::t::t::t::ttttttttz}zzzzzzzzzzzz

Archived:FILE:information

file:data

Value

description. localtfiletheadertsignature versiontneededttotextract compressiontmethod crc-wy compressedtsize uncompressedtsize

PK\x:w\x:k b: : :xOdbkdddd :xd :xd

filetdata

cHellotWorldx\nc

centraltfiletheadertsignature versiontneededttotextract crc-wy compressedtsize uncompressedtsize filetnametlength relativetoffsettoftlocaltheader

PK\x:b\x:y b: :xOdbkdddd :xd :xd < :

filetname

helloztxt

endtoftcentraltdirtsignature totaltnumbertoftentriestint tttthetcentraltdirectory sizetoftthetcentraltdirectory offsettoftstarttoftcentral tttdirectorytwithtrespecttto tttthetstartingtdisktnumber

PK\x:(\x:) b

ndefaulttvalueu

nnotcompressionu

Offset>:xbe

ttttttttttttttttttttttttttttttttttttttttttkLt)(ttttttttttttttttHe )Ct)Ct)Fty:t(Ot)FtOyt)Ct)ktybt:AtttttttttttttttttllozWorldxz

ttttttttttttttttttttttttttttttttttttttttttkLt)(ttz}zzzzzzzzzzzzHe ::> (:tkBt:wt:kt:At::t::t::t::t::t::t::t::t::tDDtDDttPKzzzzzzzzzzzzzz tt bktODt:Dt::t::t::t:Dt::t::t::t::t::t::t::ttttttttz}zzzzzzzzzzzz

simpleuZIP

bE> ttttttttttttttttttttttttttttttttttttttttttkLt)(ttz}zzzzzzzzzzzzHe tt )Ct)Ct)Fty:t(Ot)FtOyt)Ct)ktybt:AtttttttttttttttttllozWorldxz yA> ttttttttttttttttttttttttttttttttt(:tkBt:bt:yt::tttttttttttttPKzzz tt ::t:At::t::t::t::t::t::t::t::t::tDDtDDtbktODt:Dttzzzzzzzzzzzzzz}z SHAxV@:aVfdeR9dda*b8ef8b-'bd88RK8aRRc99-*RWKcad tt ::t::t::t:Dt::t::t::t:

tttttt(:tkBt:(t:)t::t::t::t::t::t::t:bt::twOt::ttttPKzzzzzzzzzzOz ::t::tyBt::t::t::t::t::ttttttttttttttttttttttttttzzmzzzzz

)Ct)Ct)Fty:t(Ot)FtOyt)Ct)ktybt:AtttttttttttttttttllozWorldxz

Archived:FILE:content

Offset>:xyb

ttttttttttttttttttttttttttttttttt(:tkBt:bt:yt::tttttttttttttPKzzz

Central:directory

ttttttttttttttttttttttttttttttttt(:tkBt:bt:yt::tttttttttttttPKzzz ::t:At::t::t::t::t::t::t::t::t::tDDtDDtbktODt:Dttzzzzzzzzzzzzzz}z ::t::t::t:Dt::t::t::t:
list:of:file:HEADERs:in:the:archive

::t:At::t::t::t::t::t::t::t::t::tDDtDDtbktODt:Dttzzzzzzzzzzzzzz}z ::t::t::t:Dt::t::t::t:
file:name

ttttttttttttttttttttttttttt)Lt)(t)Ct)Ct)FtyEtOkttttttttttthellozt OLtOkttttttttttttttttttttttttttttttttttttttttttttxt

End:of central:directory

ndefaulttvalueu

Offset>:x(<

ttttttttttttttttttttttttttt)Lt)(t)Ct)Ct)FtyEtOkttttttttttthellozt OLtOkttttttttttttttttttttttttttttttttttttttttttttxt

V

tttttt(:tkBt:(t:)t::t::t::t::t::t::t:bt::twOt::ttttPKzzzzzzzzzzOz ::t::tyBt::t::t::t::t::ttttttttttttttttttttttttttzzmzzzzz Offset>:x)y

tttttt(:tkBt:(t:)t::t::t::t::t::t::t:bt::twOt::ttttPKzzzzzzzzzzOz ::t::tyBt::t::t::t::t::ttttttttttttttttttttttttttzzmzzzzz

Parsing

:xwO :xyb

This:is:the:whole:file4:however4:most:ZIP:files:contain:many:more:elementsu Explanations:are:simplified4:for:concisenessu

the:archive:is:analyzed:backward@ :V:the:End:of:Central:Directory:is:located:2by:scanning34:and:parsed :-:the:Central:directory:is:located4:and:parsed :W:each:local:file:header:is:parsed ZIP:ARCHIVE Localtfiletheadertb tt zzz File:n Localtfiletheadertn tt File:V

relative:offset:of:local:header:V relative:offset:of:local:header:n

Centraltdirectory> ttFiletheadertb tttt ttzzz ttFiletheadertn tttt start:here

-

Endtoftcentraltdirectorytrecord

offset:of:start:of:central:directory

Trivia x:the:ZIP:format:was:created:by:Phillip:Walter:Katz4:in:VqRq x:in:the:official:specification4: . ::Structure:names:are:not:fixed4:only:describedu x:the:file:list:is:written:last:to:minimize:disk:swaps :::when:creating:multixvolume:archive:on:the:flyu x:the:filesp:Sizes:and:CRCs:are:duplicated:to:be:able:to:list:the:archive :::without:requiring:all:volumes:to:be:accessed x:A:zip:file:is:not:enforced:to:start:at:offset:*u

version:Vu** -*VWSV-S-K