Simple carving of zip file using binwalk

Question

I have been trying to use binwalk on a very large dump file without much success so far. Everytime I tried to use it, it produces very large zip file that fill the disk until I reach a disk full error (using Linux).

I am trying to understand what I did wrong, so here is a simple scenario hopefully to understand what I am doing wrong.

Steps:

$ dd if=/dev/zero of=head bs=1 count=512
$ dd if=/dev/zero of=tail bs=1 count=512
$ wget https://github.com/devttys0/binwalk/archive/master.zip
$ cat head binwalk-master.zip tail > full
$ binwalk -z -C demo -D 'zip archive:zip:unzip %e' full

Could someone please let me know why I am seeing the following:

$ find demo
demo
demo/_full.extracted
demo/_full.extracted/483BD.zip
demo/_full.extracted/200.zip

Where is this file coming from ? Is there any reason to keep it around ?

$ unzip -l demo/_full.extracted/483BD.zip 
Archive:  demo/_full.extracted/483BD.zip
5be61ad220a42e7b2c7e912024fda5edd84b4843
error [demo/_full.extracted/483BD.zip]:  missing 295357 bytes in zipfile
  (attempting to process anyway)
error [demo/_full.extracted/483BD.zip]:  attempt to seek before beginning of zipfile
  (please check that you have transferred or created the zipfile in the
  appropriate BINARY mode and that you have compiled UnZip properly)

Bonus question: is there a way to really extract only the zip file (removing the tail stuff):

$ crc32 binwalk-master.zip demo/_full.extracted/200.zip 
8ce4d36c    binwalk-master.zip
81923fef    demo/_full.extracted/200.zip
$ ls -al binwalk-master.zip demo/_full.extracted/200.zip 
-rw-r--r-- 1 user user 295419 Sep 29 08:54 binwalk-master.zip
-rw-r--r-- 1 user user 295931 Sep 29 09:02 demo/_full.extracted/200.zip

Answer 1

Binwalk produces multiple large files, because the zlib header does not contain any information about the size of the compressed data.

The following steps should be performed to extract the zip files:

• Identify headers (found at 0x200 and 0x483BD)
• Save the zip file to a file. But, because there is not any information in the header about the size, the worst case should be used and the whole remaining file should be written out.

Because the header identification cannot be perfect and false positives are possible, you cannot assume that the second header means the end of the first zip.

If you want to extract the zip files without tail, you can do the followings:

• Reverse the structure of the binary file. Generally every image part starts with a header with exact size information. You have to identify the header and size or offset values in it.
• If you works with a flash image, then you can perform entropy analysis, which helps to split the whole image into smaller parts.
• In a flash image, the parts are generally separated with several 0xFF bytes from each others. You can also use this information to extract the image parts.