3

I'm learning about stenography and found this example.

I've followed the instructions but when I write out a new zip file after changing the filename inside the file I get this:

unzip nospaces.zip
Archive:  nospaces.zip
  End-of-central-directory signature not found.  Either this file is not
  a zipfile, or it constitutes one disk of a multi-part archive.  In the
  latter case the central directory and zipfile comment will be found on
  the last disk(s) of this archive.
note:  nospaces.zip may be a plain executable, not an archive
unzip:  cannot find zipfile directory in one of nospaces.zip or
        nospaces.zip.zip, and cannot find nospaces.zip.ZIP, period.

I found that I could use zip -FF --out to 'fix' the zip file and extract the embedded contents but would like to understand what I might be doing wrong when saving the contents of the original file between 0x504B0304 and 0x506B0506

I got the same results in WinHex (32bit Windows 10 VM) and HexFiend (OSX 10.10.5 - 64bit.)

Can anyone suggest what I might have done wrong when editing the file?

enter image description here

enter image description here

1 Answer 1

2

If you consider the actual PKZipformat Each PKZIP trealer is composed by 0x506B0506 AND followed by 18 bytes handling other information like number of disk, total number of central directories, their sizes ...) so to correctly carve the zip file you should copy the block from offset 0xCB8E: Start of ZIP file

To offset 0xFA16

End of PKZip file

The result is a working ZIP file.

3
  • Thanks but this didnt work for me. I'm wondering if I am encountering endianness issues here? en.wikipedia.org/wiki/Endianness
    – codecowboy
    Oct 29, 2015 at 8:48
  • Also, I see 0504B0506, not 506B0506
    – codecowboy
    Oct 29, 2015 at 8:54
  • According to ZIP format specification each pkzip file is ended with end of central directory trailer which is 0x504B0506 (actually this is quite confusing since sometimes we refer to 0x6B sometimes 0x4B) Oct 29, 2015 at 10:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.