While trying to analyze zip files, one section Im a little confused by is the
Zip64 Extra Information Field. It is expected to be generated when specific fields can't fit in the file header(Central directory or Local) and thus we insert 0xffffffff in the header and place the actual value in the extra info field.
According to the documentation here, this can be found as one of the extra fields following the structure:
Value Size Description ----- ---- ----------- (ZIP64) 0x0001 2 bytes Tag for this "extra" block type Size 2 bytes Size of this "extra" block Original Size 8 bytes Original uncompressed file size Compressed Size 8 bytes Size of compressed data Relative Header Offset 8 bytes Offset of local header record Disk Start Number 4 bytes Number of the disk on which this file starts
This implies that I should expect the extended info entry size to be 28 bytes always.
However, when analyzing an actual Zip64 archive, I found one Central directory entry where the file offset was 0xffffffff. Next step was to look in the Extra data field for the 0x0001 header-id(expecting the data size to be 28 bytes).
However, instead I found
00 01 00 08 00 36 d4 6b ab 02 00 00 00(which translates to 0x0001 header-id, 8 bytes size and 1 field of value 0x02ab6bd436) which correctly represents the local file header offset. Why aren't the other fields mentioned in the documentation in the
Zip64 Extra Information Field?
I'm using the standard
zip utility available on Linux machines.