zipdump & PKZIP Records

    Published: 2024-11-10. Last Updated: 2024-11-10 15:14:06 UTC
    by Didier Stevens (Version: 1)
    0 comment(s)

    In yesterday's diary entry "zipdump & Evasive ZIP Concatenation" I showed how one can inspect the PKZIP records that make up a ZIP file.

    My tool zipdump.py can also inspect the data of PKZIP file records, and decompress it (not decrypt it).

    To select the data of a PKZIP file record, use option -s data. Here we also use option -a to do a hex-ascii dump of the data:

    When option -d is used (to perform a binary dump), only the raw data is send to stdout, no other metadata:

    And when option -s decompress is used, the data is decompressed (only INFLATE is supported):

    These options could also be helpful for corrupt ZIP files.

     

    Didier Stevens
    Senior handler
    blog.DidierStevens.com

    Keywords:
    0 comment(s)

      Comments


      Diary Archives