: Once lengths and CRC values are consistent, standard tools like 7z or unzip will be able to process the file correctly. CTFtime.org / PlaidCTF 2017 / zipper / Writeup
: Open the file in a tool like 010 Editor or Hxd . Look for the filename length at 0x1A . If the actual filename is just a few characters (like flag.txt ) but the length is 9001 , manually change it to the correct length (e.g., 0x08 ). C32zip
: The "Extra Field" length and content are often manipulated to hide data or throw off automated parsers. : Once lengths and CRC values are consistent,
In this specific challenge, players are given a ZIP file ( zipp.zip ) that appears broken. Upon inspection with a hex editor, several issues are discovered that prevent standard extraction: If the actual filename is just a few characters (like flag
: Use binwalk or file to confirm it is a ZIP. Try to unzip it; if it fails with "filename too long" or "offset error," the headers are tampered with.
: Located at offset 0x0E . This is the checksum of the uncompressed data. Compressed Size (4 bytes) : Offset 0x12 . Uncompressed Size (4 bytes) : Offset 0x16 .