0

I have a DLL with the following code which decrypts and decompresses an old PKZip 2.0 file...

basic_string<char,std::char_traits<char>,std::allocator<char> > basic_string<char,std::char_traits<char>,std::allocator<char> >3;
basic_string<char,std::char_traits<char>,std::allocator<char> >* ptr3 = <Module>.to_string(&basic_string<char,std::char_traits<char>,std::allocator<char> >3, sPassword);
<Module>.addUNZIP_Decrypt(<Module>.std.basic_string<char,std::char_traits<char>,std::allocator<char> >.c_str(ptr3));
<Module>.addUNZIP_Overwrite(11);
<Module>.addUNZIP_InstallCallback(<Module>.__unep@?zip_callback@?A0xb8f18585@@$$FYGHFFPAD@Z);
<Module>.addUNZIP_View(0);

ptr3 is the pointer to the password string. What's strange is that the prior line has the password, but the password doesn't work when I try to unzip the file manually with 7Zip, WinRAR, or PKZip. ...yet the program does it successfully.

Is it possible the ZIP/UNZIP calls are modifying the password (like adding an unprintable 00 to the end or something)?

3
  • You can use a tool like signsrch on the executable, to get further insights on the compresion/encryption algorithm used.
    – 0xec
    Mar 15, 2015 at 5:55
  • Does that password contain any unusual characters, or is it limited to a usual set of alphanumerics?
    – Jongware
    Mar 15, 2015 at 10:57
  • The password is 10 latin alpha-numeric chars. I tried running a brute force on the archives, but it doesn't recognize the password, or anything similar. Mar 15, 2015 at 11:43

1 Answer 1

2

Is it possible the ZIP/UNZIP calls are modifying the password

Yes, it's possible that <Module>.addUNZIP_Decrypt() modifies the password, or draws a giraffe on your screen, or plays The Star Spangled Banner out through your speakers.

You need to reverse engineer the function to determine what it does.

2
  • This module is Stephen Darlington's original PKZip library 0.69. I doubt he's drawing a giraffe. Let me see if the source is public... Mar 15, 2015 at 16:16
  • Sadly, it looks like the source is still private despite being written in 1995. In any case, I cannot imagine that the addZip module modifies the password. I'm leaning towards the possibility that the file format is somehow not compatible with modern compression programs. Mar 15, 2015 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.