[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 28 Feb 2012 08:24:37 +0100
From: magnum <john.magnum@...hmail.com>
To: john-dev@...ts.openwall.com
Subject: Re: Re: [JtR PATCH] Support rar's -p mode by spawning
external unrar process.
On 02/28/2012 07:39 AM, Dhiru Kholia wrote:
> On Tue, Feb 28, 2012 at 2:37 AM, magnum <john.magnum@...hmail.com> wrote:
>> We would still have this -p mode problem but with more power under the
>> hood someone might get the idea to fix that. If I got it right, this is
>> only about quickly verifying or rejecting the decrypted data, just like
>> Jim did with pkzip. I bet we can find some situations where we can
>> reject early, if we just get the full CRC in place first.
>
> In RAR format, there is no CRC stored for the compressed (decrypted)
> data. So there is no quick way to verify / reject it. The CRC stored
> is for the original uncompressed file.
Yes, but sometimes we should be able to decompress just some of it and
then decide to reject early, based on other things than CRC. We do know
the file name: If the file is an .EXE we can compress just enough to
look for a PE header, for example. If we're unsure we need to decompress
the whole file (which may be huge).
I'm currently trying to establish whether RAR3 can use any of all
supported compression algorithms or if we just have one (PPMII) to deal
with. There seem to be a VM involved. The Wikipedia page mentions a
specialized "routine" for multimedia files.
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
