While trying to analyze zip files, one section Im a little confused by is the Zip64 Extra Information Field
. It is expected to be generated when specific fields can't fit in the file header(Central directory or Local) and thus we insert 0xffffffff in the header and place the actual value in the extra info field.
According to the documentation here, this can be found as one of the extra fields following the structure:
Value Size Description
----- ---- -----------
(ZIP64) 0x0001 2 bytes Tag for this "extra" block type
Size 2 bytes Size of this "extra" block
Original
Size 8 bytes Original uncompressed file size
Compressed
Size 8 bytes Size of compressed data
Relative Header
Offset 8 bytes Offset of local header record
Disk Start
Number 4 bytes Number of the disk on which
this file starts
This implies that I should expect the extended info entry size to be 28 bytes always.
However, when analyzing an actual Zip64 archive, I found one Central directory entry where the file offset was 0xffffffff. Next step was to look in the Extra data field for the 0x0001 header-id(expecting the data size to be 28 bytes).
However, instead I found 00 01 00 08 00 36 d4 6b ab 02 00 00 00
(which translates to 0x0001 header-id, 8 bytes size and 1 field of value 0x02ab6bd436) which correctly represents the local file header offset. Why aren't the other fields mentioned in the documentation in the Zip64 Extra Information Field
?
I'm using the standard zip
utility available on Linux machines.