C32zip

: The "Extra Field" length and content are often manipulated to hide data or throw off automated parsers.

: Once lengths and CRC values are consistent, standard tools like 7z or unzip will be able to process the file correctly. CTFtime.org / PlaidCTF 2017 / zipper / Writeup C32zip

In this specific challenge, players are given a ZIP file ( zipp.zip ) that appears broken. Upon inspection with a hex editor, several issues are discovered that prevent standard extraction: : The "Extra Field" length and content are

To solve these "C32" related zip challenges, one must understand the ZIP file format : : Starts with the signature 50 4B 03 04 . Upon inspection with a hex editor, several issues

: If the file is encrypted or the data is missing, check the uncompressed size . If the size is very small (e.g., 4-6 bytes), you can use a script to find which alphanumeric string produces the CRC32 hash found in the header.

: Offset 0x1A . This is the value often tampered with in CTF challenges like "zipper". Solving Steps (Long Write-up Style)