[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 09 Aug 2012 01:14:23 +0400
From: Pavel Semjanov <pavel@...janov.com>
To: john-dev@...ts.openwall.com
Subject: Re: Patch for pkzip_fmt_plug.c from jumbo-6
Jim,
as you know, there are too much software which could make zip
archives. I don't know how attached archives were created exactly. So,
if you try to re-zip these files with password you probably don't get
exact the same byte sequence as original files. Anyway, if you pass the
original byte sequence to your function, you easily could find the errors.
I've made 3 things:
1) the main error is the line
whave += dist;
which should be
whave += len;
It's evident, isn't it? Future.zip shows this bug.
2) the 2nd level codes are not present neither in distfix nor in lenfix.
It can be checked easily. So, I remove the code with 2nd level codes.
3) end-of-block, however, could occur in first 24 bytes. So, to
distinguish the right and wrong sequence, I add the code:
if (left == 0) return 1;
else return 0;
9bytes.zip is the sample with end-of-block marker at the first bytes.
On 08.08.2012 19:36, jfoug wrote:
> I have done both of these with encryption, and both crack (older code).
>
> Note, the code was NEVER intended to be proper .zip processing. Just to
> detect that if the current password is used, that the decoded stream is
> invalid.
>
> Possibly I need to make more tests, using different passwords (I will setup
> a script to do just that). But with this initial test, the old code appears
> to not miss anything.
>
> Can you validate that the .zip stream sent imploaded the data properly, and
> that something simple like that did not cause these test files to succeed.
> I am going to make many crypt files (using different passwords), on the same
> data, and see if JtR misses any of them.
>
> Note the password is 'password' in both .zip files.
>
> Jim.
>
>> From: Pavel Semjanov [mailto:pavel@...janov.com]
>> Sent: Monday, August 06, 2012 7:16 AM
>> To: john-dev@...ts.openwall.com
>> Cc: magnum
>> Subject: Re: [john-dev] Patch for pkzip_fmt_plug.c from jumbo-6
>>
>>> On 2012-07-27 11:10, Pavel Semjanov wrote:
>>>> Hello,
>>>>
>>>> I've tested and fixed some errors (one is severe, the code was not
>>>> working on some files!) in function check_inflate_CODE1().
>>>> The patch is attached.
>>>> s
>>>
>>> Pavel,
>>>
>>> Thanks, this is really appreciated! Could you possibly supply test
>>> files showing the problem? This would make our audit a lot easier and
>> faster.
>>
>> I've attached two files. The first one (future.zip) has a false early
>> reject. The second one passes ok early reject, but only by accident - it
>> has end-of-block marker in the first 8 bytes, so the logic of the
>> function is wrong.
--
SY / C4acT/\uBo Pavel Semjanov
_ _ _ http://www.semjanov.com
| | |-| |_|_| |-|
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
