1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
|
.\" -*- mode: troff; coding: utf-8 -*-
.\" Automatically generated by Pod::Man 5.01 (Pod::Simple 3.43)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>.
.ie n \{\
. ds C` ""
. ds C' ""
'br\}
.el\{\
. ds C`
. ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD. Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
. if \nF \{\
. de IX
. tm Index:\\$1\t\\n%\t"\\$2"
..
. if !\nF==2 \{\
. nr % 0
. nr F 2
. \}
. \}
.\}
.rr rF
.\" ========================================================================
.\"
.IX Title "ZIPDETAILS 1"
.TH ZIPDETAILS 1 2024-04-05 "perl v5.38.2" "Perl Programmers Reference Guide"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH NAME
zipdetails \- display the internal structure of zip files
.SH SYNOPSIS
.IX Header "SYNOPSIS"
.Vb 3
\& zipdetails [\-v][\-\-scan][\-\-redact][\-\-utc] zipfile.zip
\& zipdetails \-h
\& zipdetails \-\-version
.Ve
.SH DESCRIPTION
.IX Header "DESCRIPTION"
This program creates a detailed report on the internal structure of zip
files. For each item of metadata within a zip file the program will output
.IP "the offset into the zip file where the item is located." 5
.IX Item "the offset into the zip file where the item is located."
.PD 0
.IP "a textual representation for the item." 5
.IX Item "a textual representation for the item."
.IP "an optional hex dump of the item." 5
.IX Item "an optional hex dump of the item."
.PD
.PP
The program assumes a prior understanding of the internal structure of Zip
files. You should have a copy of the Zip
APPNOTE.TXT <http://www.pkware.com/documents/casestudies/APPNOTE.TXT> file
at hand to help understand the output from this program.
.SS "Default Behaviour"
.IX Subsection "Default Behaviour"
By default the program expects to be given a well-formed zip file. It will
navigate the Zip file by first parsing the zip central directory at the end
of the file. If that is found, it will then walk through the zip records
starting at the beginning of the file. Any badly formed zip data structures
encountered are likely to terminate the program.
.PP
If the program finds any structural problems with the zip file it will
print a summary at the end of the output report. The set of error cases
reported is very much a work in progress, so don't rely on this feature to
find all the possible errors in a zip file. If you have suggestions for
use-cases where this could be enhanced please consider creating an
enhancement request (see "SUPPORT").
.PP
Date/time fields are found in zip files are displayed in local time. Use
the \f(CW\*(C`\-\-utc\*(C'\fR option to display these fields in Coordinated Universal Time
(UTC).
.SS Scan-Mode
.IX Subsection "Scan-Mode"
If you do have a potentially corrupt zip file, particulatly where the
central directory at the end of the file is absent/incomplete, you can try
usng the \f(CW\*(C`\-\-scan\*(C'\fR option to search for zip records that are still present.
.PP
When Scan-mode is enabled, the program will walk the zip file from the
start, blindly looking for the 4\-byte signatures that preceed each of the
zip data structures. If it finds any of the recognised signatures it will
attempt to dump the associated zip record. For very large zip files, this
operation can take a long time to run.
.PP
Note that the 4\-byte signatures used in zip files can sometimes match with
random data stored in the zip file, so care is needed interpreting the
results.
.SS OPTIONS
.IX Subsection "OPTIONS"
.IP \-h 5
.IX Item "-h"
Display help
.IP \-\-redact 5
.IX Item "--redact"
Obscure filenames in the output. Handy for the use case where the zip files
contains sensitive data that cannot be shared.
.IP \-\-scan 5
.IX Item "--scan"
Walk the zip file loking for possible zip records. Can be error-prone.
See "Scan-Mode"
.IP \-\-utc 5
.IX Item "--utc"
By default, date/time fields are displayed in local time. Use this option
to display them in in Coordinated Universal Time (UTC).
.IP \-v 5
.IX Item "-v"
Enable Verbose mode. See "Verbose Output".
.IP \-\-version 5
.IX Item "--version"
Display version number of the program and exit.
.SS "Default Output"
.IX Subsection "Default Output"
By default zipdetails will output the details of the zip file in three
columns.
.IP "Column 1" 5
.IX Item "Column 1"
This contains the offset from the start of the file in hex.
.IP "Column 2" 5
.IX Item "Column 2"
This contains a textual description of the field.
.IP "Column 3" 5
.IX Item "Column 3"
If the field contains a numeric value it will be displayed in hex. Zip
stores most numbers in little-endian format \- the value displayed will have
the little-endian encoding removed.
.Sp
Next, is an optional description of what the value means.
.PP
For example, assuming you have a zip file with two entries, like this
.PP
.Vb 8
\& $ unzip \-l test.zip
\& Archive: setup/test.zip
\& Length Date Time Name
\& \-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-\-\-\- \-\-\-\-\- \-\-\-\-
\& 6 2021\-03\-23 18:52 latters.txt
\& 6 2021\-03\-23 18:52 numbers.txt
\& \-\-\-\-\-\-\-\-\- \-\-\-\-\-\-\-
\& 12 2 files
.Ve
.PP
Running \f(CW\*(C`zipdetails\*(C'\fR will gives this output
.PP
.Vb 1
\& $ zipdetails test.zip
\&
\& 0000 LOCAL HEADER #1 04034B50
\& 0004 Extract Zip Spec 0A \*(Aq1.0\*(Aq
\& 0005 Extract OS 00 \*(AqMS\-DOS\*(Aq
\& 0006 General Purpose Flag 0000
\& 0008 Compression Method 0000 \*(AqStored\*(Aq
\& 000A Last Mod Time 5277983D \*(AqTue Mar 23 19:01:58 2021\*(Aq
\& 000E CRC 0F8A149C
\& 0012 Compressed Length 00000006
\& 0016 Uncompressed Length 00000006
\& 001A Filename Length 000B
\& 001C Extra Length 0000
\& 001E Filename \*(Aqletters.txt\*(Aq
\& 0029 PAYLOAD abcde.
\&
\& 002F LOCAL HEADER #2 04034B50
\& 0033 Extract Zip Spec 0A \*(Aq1.0\*(Aq
\& 0034 Extract OS 00 \*(AqMS\-DOS\*(Aq
\& 0035 General Purpose Flag 0000
\& 0037 Compression Method 0000 \*(AqStored\*(Aq
\& 0039 Last Mod Time 5277983D \*(AqTue Mar 23 19:01:58 2021\*(Aq
\& 003D CRC 261DAFE6
\& 0041 Compressed Length 00000006
\& 0045 Uncompressed Length 00000006
\& 0049 Filename Length 000B
\& 004B Extra Length 0000
\& 004D Filename \*(Aqnumbers.txt\*(Aq
\& 0058 PAYLOAD 12345.
\&
\& 005E CENTRAL HEADER #1 02014B50
\& 0062 Created Zip Spec 1E \*(Aq3.0\*(Aq
\& 0063 Created OS 03 \*(AqUnix\*(Aq
\& 0064 Extract Zip Spec 0A \*(Aq1.0\*(Aq
\& 0065 Extract OS 00 \*(AqMS\-DOS\*(Aq
\& 0066 General Purpose Flag 0000
\& 0068 Compression Method 0000 \*(AqStored\*(Aq
\& 006A Last Mod Time 5277983D \*(AqTue Mar 23 19:01:58 2021\*(Aq
\& 006E CRC 0F8A149C
\& 0072 Compressed Length 00000006
\& 0076 Uncompressed Length 00000006
\& 007A Filename Length 000B
\& 007C Extra Length 0000
\& 007E Comment Length 0000
\& 0080 Disk Start 0000
\& 0082 Int File Attributes 0001
\& [Bit 0] 1 Text Data
\& 0084 Ext File Attributes 81B40000
\& 0088 Local Header Offset 00000000
\& 008C Filename \*(Aqletters.txt\*(Aq
\&
\& 0097 CENTRAL HEADER #2 02014B50
\& 009B Created Zip Spec 1E \*(Aq3.0\*(Aq
\& 009C Created OS 03 \*(AqUnix\*(Aq
\& 009D Extract Zip Spec 0A \*(Aq1.0\*(Aq
\& 009E Extract OS 00 \*(AqMS\-DOS\*(Aq
\& 009F General Purpose Flag 0000
\& 00A1 Compression Method 0000 \*(AqStored\*(Aq
\& 00A3 Last Mod Time 5277983D \*(AqTue Mar 23 19:01:58 2021\*(Aq
\& 00A7 CRC 261DAFE6
\& 00AB Compressed Length 00000006
\& 00AF Uncompressed Length 00000006
\& 00B3 Filename Length 000B
\& 00B5 Extra Length 0000
\& 00B7 Comment Length 0000
\& 00B9 Disk Start 0000
\& 00BB Int File Attributes 0001
\& [Bit 0] 1 Text Data
\& 00BD Ext File Attributes 81B40000
\& 00C1 Local Header Offset 0000002F
\& 00C5 Filename \*(Aqnumbers.txt\*(Aq
\&
\& 00D0 END CENTRAL HEADER 06054B50
\& 00D4 Number of this disk 0000
\& 00D6 Central Dir Disk no 0000
\& 00D8 Entries in this disk 0002
\& 00DA Total Entries 0002
\& 00DC Size of Central Dir 00000072
\& 00E0 Offset to Central Dir 0000005E
\& 00E4 Comment Length 0000
\& Done
.Ve
.SS "Verbose Output"
.IX Subsection "Verbose Output"
If the \f(CW\*(C`\-v\*(C'\fR option is present, column 1 is expanded to include
.IP \(bu 5
The offset from the start of the file in hex.
.IP \(bu 5
The length of the field in hex.
.IP \(bu 5
A hex dump of the bytes in field in the order they are stored in the zip
file.
.PP
Here is the same zip file dumped using the \f(CW\*(C`zipdetails\*(C'\fR \f(CW\*(C`\-v\*(C'\fR option:
.PP
.Vb 1
\& $ zipdetails \-v test.zip
\&
\& 0000 0004 50 4B 03 04 LOCAL HEADER #1 04034B50
\& 0004 0001 0A Extract Zip Spec 0A \*(Aq1.0\*(Aq
\& 0005 0001 00 Extract OS 00 \*(AqMS\-DOS\*(Aq
\& 0006 0002 00 00 General Purpose Flag 0000
\& 0008 0002 00 00 Compression Method 0000 \*(AqStored\*(Aq
\& 000A 0004 3D 98 77 52 Last Mod Time 5277983D \*(AqTue Mar 23 19:01:58 2021\*(Aq
\& 000E 0004 9C 14 8A 0F CRC 0F8A149C
\& 0012 0004 06 00 00 00 Compressed Length 00000006
\& 0016 0004 06 00 00 00 Uncompressed Length 00000006
\& 001A 0002 0B 00 Filename Length 000B
\& 001C 0002 00 00 Extra Length 0000
\& 001E 000B 6C 65 74 74 Filename \*(Aqletters.txt\*(Aq
\& 65 72 73 2E
\& 74 78 74
\& 0029 0006 61 62 63 64 PAYLOAD abcde.
\& 65 0A
\&
\& 002F 0004 50 4B 03 04 LOCAL HEADER #2 04034B50
\& 0033 0001 0A Extract Zip Spec 0A \*(Aq1.0\*(Aq
\& 0034 0001 00 Extract OS 00 \*(AqMS\-DOS\*(Aq
\& 0035 0002 00 00 General Purpose Flag 0000
\& 0037 0002 00 00 Compression Method 0000 \*(AqStored\*(Aq
\& 0039 0004 3D 98 77 52 Last Mod Time 5277983D \*(AqTue Mar 23 19:01:58 2021\*(Aq
\& 003D 0004 E6 AF 1D 26 CRC 261DAFE6
\& 0041 0004 06 00 00 00 Compressed Length 00000006
\& 0045 0004 06 00 00 00 Uncompressed Length 00000006
\& 0049 0002 0B 00 Filename Length 000B
\& 004B 0002 00 00 Extra Length 0000
\& 004D 000B 6E 75 6D 62 Filename \*(Aqnumbers.txt\*(Aq
\& 65 72 73 2E
\& 74 78 74
\& 0058 0006 31 32 33 34 PAYLOAD 12345.
\& 35 0A
\&
\& 005E 0004 50 4B 01 02 CENTRAL HEADER #1 02014B50
\& 0062 0001 1E Created Zip Spec 1E \*(Aq3.0\*(Aq
\& 0063 0001 03 Created OS 03 \*(AqUnix\*(Aq
\& 0064 0001 0A Extract Zip Spec 0A \*(Aq1.0\*(Aq
\& 0065 0001 00 Extract OS 00 \*(AqMS\-DOS\*(Aq
\& 0066 0002 00 00 General Purpose Flag 0000
\& 0068 0002 00 00 Compression Method 0000 \*(AqStored\*(Aq
\& 006A 0004 3D 98 77 52 Last Mod Time 5277983D \*(AqTue Mar 23 19:01:58 2021\*(Aq
\& 006E 0004 9C 14 8A 0F CRC 0F8A149C
\& 0072 0004 06 00 00 00 Compressed Length 00000006
\& 0076 0004 06 00 00 00 Uncompressed Length 00000006
\& 007A 0002 0B 00 Filename Length 000B
\& 007C 0002 00 00 Extra Length 0000
\& 007E 0002 00 00 Comment Length 0000
\& 0080 0002 00 00 Disk Start 0000
\& 0082 0002 01 00 Int File Attributes 0001
\& [Bit 0] 1 Text Data
\& 0084 0004 00 00 B4 81 Ext File Attributes 81B40000
\& 0088 0004 00 00 00 00 Local Header Offset 00000000
\& 008C 000B 6C 65 74 74 Filename \*(Aqletters.txt\*(Aq
\& 65 72 73 2E
\& 74 78 74
\&
\& 0097 0004 50 4B 01 02 CENTRAL HEADER #2 02014B50
\& 009B 0001 1E Created Zip Spec 1E \*(Aq3.0\*(Aq
\& 009C 0001 03 Created OS 03 \*(AqUnix\*(Aq
\& 009D 0001 0A Extract Zip Spec 0A \*(Aq1.0\*(Aq
\& 009E 0001 00 Extract OS 00 \*(AqMS\-DOS\*(Aq
\& 009F 0002 00 00 General Purpose Flag 0000
\& 00A1 0002 00 00 Compression Method 0000 \*(AqStored\*(Aq
\& 00A3 0004 3D 98 77 52 Last Mod Time 5277983D \*(AqTue Mar 23 19:01:58 2021\*(Aq
\& 00A7 0004 E6 AF 1D 26 CRC 261DAFE6
\& 00AB 0004 06 00 00 00 Compressed Length 00000006
\& 00AF 0004 06 00 00 00 Uncompressed Length 00000006
\& 00B3 0002 0B 00 Filename Length 000B
\& 00B5 0002 00 00 Extra Length 0000
\& 00B7 0002 00 00 Comment Length 0000
\& 00B9 0002 00 00 Disk Start 0000
\& 00BB 0002 01 00 Int File Attributes 0001
\& [Bit 0] 1 Text Data
\& 00BD 0004 00 00 B4 81 Ext File Attributes 81B40000
\& 00C1 0004 2F 00 00 00 Local Header Offset 0000002F
\& 00C5 000B 6E 75 6D 62 Filename \*(Aqnumbers.txt\*(Aq
\& 65 72 73 2E
\& 74 78 74
\&
\& 00D0 0004 50 4B 05 06 END CENTRAL HEADER 06054B50
\& 00D4 0002 00 00 Number of this disk 0000
\& 00D6 0002 00 00 Central Dir Disk no 0000
\& 00D8 0002 02 00 Entries in this disk 0002
\& 00DA 0002 02 00 Total Entries 0002
\& 00DC 0004 72 00 00 00 Size of Central Dir 00000072
\& 00E0 0004 5E 00 00 00 Offset to Central Dir 0000005E
\& 00E4 0002 00 00 Comment Length 0000
\& Done
.Ve
.SH LIMITATIONS
.IX Header "LIMITATIONS"
The following zip file features are not supported by this program:
.IP \(bu 5
Multi-part archives.
.IP \(bu 5
The strong encryption features defined in the APPNOTE.TXT <http://www.pkware.com/documents/casestudies/APPNOTE.TXT> document.
.SH TODO
.IX Header "TODO"
Error handling is a work in progress. If the program encounters a problem
reading a zip file it is likely to terminate with an unhelpful error
message.
.SH SUPPORT
.IX Header "SUPPORT"
General feedback/questions/bug reports should be sent to
<https://github.com/pmqs/zipdetails/issues>.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
The primary reference for Zip files is
APPNOTE.TXT <http://www.pkware.com/documents/casestudies/APPNOTE.TXT>.
.PP
An alternative reference is the Info-Zip appnote. This is available from
<ftp://ftp.info\-zip.org/pub/infozip/doc/>
.PP
For details of WinZip AES encryption see AES Encryption Information:
Encryption Specification AE\-1 and AE\-2 <https://www.winzip.com/win/es/aes_info.html>.
.PP
The \f(CW\*(C`zipinfo\*(C'\fR program that comes with the info-zip distribution
(<http://www.info\-zip.org/>) can also display details of the structure of
a zip file.
.SH AUTHOR
.IX Header "AUTHOR"
Paul Marquess \fIpmqs@cpan.org\fR.
.SH COPYRIGHT
.IX Header "COPYRIGHT"
Copyright (c) 2011\-2022 Paul Marquess. All rights reserved.
.PP
This program is free software; you can redistribute it and/or modify it
under the same terms as Perl itself.
|
