I was given two files without extensions and was told to decrypt them.


Both ZIP and JPG files have well known magic numbers at the start of the file. For examples, ZIP files start with the two letters "PK" (most likely as the initials of Phil Katz, the developer of PKZIP), followed by the bytes 03 04 to indicate a "file header".

If all you know is that the files are an encrypted ZIP file and a JPG image, probably a very simple cipher like bytewise XOR or addition of a constant to each byte is used to keep the puzzle solvable. The well-known bytes at the file start allow you to deduce the key. This kind of attack is called a "known-plaintext attack".

  • i am bit confused for example i opened up the supposed zip file with a text editor and the first characters are DC2WHU9ZY i think dc2 is just a symbol since it was highlighted in black. when I xor with pk0304 i do not really get anything
    – han
    Sep 18 at 13:44
  • also the image file is just a bunch of gibberish can't make out any actual letters
    – han
    Sep 18 at 14:04
  • also what do you do when you get part of the key how do u know what the rest is?
    – han
    Sep 18 at 15:06
  • i figured out the zip file but now for the image not sure if it is jpg? the only thing I was told is that it was take with a kodak dcs200
    – han
    Sep 18 at 16:00
  • Congratulations for tackling the ZIP file. For photos, I would be 90% confident it is standard JPG, although it might be a raw format supported by the camera. If you know the camera model, you know certain pieces of the EXIF tag, which can help you a lot. Try finding example images taken with that camera model on the internet - and make sure you get the JPG as written by the camera ("out of cam"), not a processed JPG file. Sep 18 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.