In yesterday’s diary entry “zipdump & Evasive ZIP Concatenation” I showed how one can inspect the PKZIP records that make up a ZIP file.

My tool zipdump.py can also inspect the data of PKZIP file records, and decompress it (not decrypt it).

To select the data of a PKZIP file record, use option -s data. Here we also use option -a to do a hex-ascii dump of the data:

When option -d is used (to perform a binary dump), only the raw data is send to stdout, no other metadata:

And when option -s decompress is used, the data is decompressed (only INFLATE is supported):

These options could also be helpful for corrupt ZIP files.

 

Didier Stevens
Senior handler
blog.DidierStevens.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.