If an application is reading from a password protected zip file, is there a way to intercept the key being sent to decrypt the zip file. Or, is there a way to dump the files being read themselves?
I'm writing this answer under the assumption the OP is within his legal rights to share the binaries.
First of, I read up on password protected zip files. Apparently that is not part of the ZIP specification itself but an invention of WinZip. They have documented their format modifications and all details on this page:
Important to notice here is how key derivation works. It feeds the given password through PKBDF2 with an iteration count of 1000 to derive the real key used in AES.
Using PEiD I checked for crypto signatures and found 4 references to AES (via their sbox). I then checked the surrounding code where these AES functions are used and stumbled upon a function call that got 1000 as an argument.
So then I just ran the binary with an attached debugger, breaking on that call. Then I inspected passed arguments and the first argument appeared to be the key.
I successfully decompressed the female zip file with the key to confirm.
How to derive that key?
Note that the algorithm used by the program seems to be a bit more complex. If you check the zip files, not all files in there are encrypted.
Two XML files are unencrypted and contain an XML property named
encryption key, which looks similar to the real one above, but different bytes.
The application probably uses this property to deduce the above key which is eventually fed to AES to decrypt the encrypted files in the same archive. I do not know how this internal derivation works. You would have to find the code, probably by following the XML parser if you want to write a generic tool to decompress these encrypted files.