逆向 .dzip：从 UA 魔数到被改过密码的 WinZip AES

>>> import zlib, binascii
>>> zlib.decompress(bytes([0x2b,0x49,0xad,0x28,0x01,0x00]), -15)
b'text'
>>> hex(binascii.crc32(b'text') & 0xffffffff)
'0x3b8ba7c7'   # 和数据描述符里的 c7a78b3b (小端) 一致

import struct, zlib, binascii, os

SIG_LOCAL   = b"UA\x03\x04"
SIG_CENTRAL = b"UA\x01\x02"
SIG_EOCD    = b"UA\x05\x06"

# 签名之后的字段
LFH   = struct.Struct("<HHHHHIIIHH")   # 版本,flag,方法,时间,日期,crc,comp,uncomp,nlen,elen
CDFH  = struct.Struct("<HHHHHHIIIHHHHHII")  # 多了 vmade, commentlen, disk, iattr, eattr, loff
EOCD  = struct.Struct("<HHHHIIH")       # disk,cd_disk,n_disk,n_total,cd_size,cd_off,comment_len

def find_eocd(data):
    """dzip 在 EOCD 后追加了 64 字节 footer (comment_len==0),
    所以不能要求 EOCD 正好落在文件尾。改成: 倒着扫签名, 找到第一个
    其声称的中央目录偏移确实指向 UA\x01\x02 的候选。"""
    start = max(0, len(data) - (22 + 0xFFFF))
    pos = data.rfind(SIG_EOCD, start)
    while pos != -1:
        if pos + 22 <= len(data):
            cd_off = EOCD.unpack(data[pos+4:pos+22])[5]
            if 0 <= cd_off < pos and data[cd_off:cd_off+4] == SIG_CENTRAL:
                return pos
        pos = data.rfind(SIG_EOCD, start, pos)
    raise ValueError("EOCD not found")

def read_entries(data):
    p = find_eocd(data)
    _, _, _, n_total, _, cd_off, _ = EOCD.unpack(data[p+4:p+22])
    entries = []
    q = cd_off
    for _ in range(n_total):
        f = CDFH.unpack(data[q+4:q+46])
        method, crc, comp, uncomp, nlen, elen, loff = f[3], f[6], f[7], f[8], f[9], f[10], f[15]
        name = data[q+46:q+46+nlen].decode("utf-8", "replace")
        entries.append(dict(name=name, method=method, crc=crc, comp=comp,
                            uncomp=uncomp, loff=loff))
        q += 46 + nlen + elen + f[11]   # f[11] = comment_len
    return entries

def read_payload(data, e):
    """用本地头自己的 nlen/elen 算数据起点; 长度用中央目录的 comp。"""
    p = e["loff"]
    nlen, elen = LFH.unpack(data[p+4:p+30])[8:10]
    start = p + 30 + nlen + elen
    return data[start:start + e["comp"]]

def decompress(raw, method):
    if method == 0:  return raw               # Stored
    if method == 8:  return zlib.decompress(raw, -zlib.MAX_WBITS)  # raw deflate
    raise ValueError(f"unsupported method {method}")

import hashlib, hmac, struct
from Crypto.Cipher import AES
from Crypto.Util import Counter

# 解析 std.zip 拿到 salt/verify/ct/auth (省略, 同前)
dk = hashlib.pbkdf2_hmac("sha1", b"zyzy", salt, 1000, 2*32 + 2)
enc_key, mac_key = dk[:32], dk[32:64]

# verify
assert dk[64:66] == verify
# HMAC 鉴权
assert hmac.new(mac_key, ct, hashlib.sha1).digest()[:10] == auth
# 解密
ctr = Counter.new(128, initial_value=1, little_endian=True)
pt = AES.new(enc_key, AES.MODE_CTR, counter=ctr).decrypt(ct)
assert pt == open("secret.txt","rb").read()

>>> dk = hashlib.pbkdf2_hmac("sha1", b"123456789", salt, 1000, 66)
>>> dk[64:66].hex()
'03a7'
>>> verify.hex()  # 存的是
'19ef'

>>> import zlib
>>> zlib.compress(b'hello,world', 5)[2:-4].hex()   # 去掉 2 字节 zlib 头和 4 字节 adler
'cb48cdc9c9d729cf2fca490100'   # 13 字节, 和 ct 长度一致

pt = bytes.fromhex("cb48cdc9c9d729cf2fca490100")
ct = bytes.fromhex("9630388dac879df34f69697856")
ks = bytes(a ^ b for a, b in zip(pt, ct))
# 5d78f5446550b43c60a3207956   (13 字节)

>>> for it in range(1, 10001):
...     dk = hashlib.pbkdf2_hmac("sha1", b"123456789", salt16, it, 66)
...     if dk[64:66] == verify:   # verify = 19ef
...         print(it)
6241

import struct, zlib, hashlib, hmac, binascii
from Crypto.Cipher import AES
from Crypto.Util import Counter

def find_byte_and_decrypt(stored, base_pw):
    """stored = salt(16)+verify(2)+ct+auth(10). 返回明文 deflate 流。"""
    salt, verify = stored[:16], stored[16:18]
    auth, ct = stored[-10:], stored[18:-10]
    for b in range(1, 256):
        pw = base_pw + bytes([b])
        dk = hashlib.pbkdf2_hmac("sha1", pw, salt, 1000, 2*32 + 2)
        if dk[64:66] != verify:          # 16 位初筛
            continue
        if hmac.new(dk[32:64], ct, hashlib.sha1).digest()[:10] != auth:  # 80 位终判
            continue
        ctr = Counter.new(128, initial_value=1, little_endian=True)
        return AES.new(dk[:32], AES.MODE_CTR, counter=ctr).decrypt(ct)
    raise ValueError("byte not in 1..255")

byte=110 (0x6e) verify=OK mac=True ks=True
password = b'123456789' + b'n'   ->  b'123456789n'
decrypted: b'hello,world'  crc ok

def decrypt_aes(stored, candidate_passwords, aes, name):
    """stored = salt || verify(2) || ciphertext || auth(10)。
    依次试候选密码, 第一个 verify(16位)+HMAC(80位) 都过的用于解密。
    返回 (明文压缩流, 命中的密码)。dzip 会往密码末尾追加 1 字节,
    所以调用方应传入 [原始密码, 原始密码+byte 1..255]。"""
    import hashlib
    key_size, salt_size, _actual, _vver = aes
    salt = stored[:salt_size]
    pw_verify = stored[salt_size:salt_size + AES_PW_VERIFY]   # 2
    auth_code = stored[-AES_AUTH_LEN:]                        # 10
    ciphertext = stored[salt_size + AES_PW_VERIFY:-AES_AUTH_LEN]
    dklen = 2 * key_size + AES_PW_VERIFY

    AES, Counter = _load_crypto()
    for pw in candidate_passwords:
        dk = hashlib.pbkdf2_hmac("sha1", pw, salt, AES_ITERATIONS, dklen)  # 1000 轮
        # 16 位 verify 初筛
        if not _hmac.compare_digest(
                dk[2*key_size:2*key_size + AES_PW_VERIFY], pw_verify):
            continue
        # 80 位 HMAC 终判 (算的是密文, 截前 10 字节)
        mac = _hmac.new(dk[key_size:2*key_size], ciphertext, hashlib.sha1).digest()
        if not _hmac.compare_digest(mac[:AES_AUTH_LEN], auth_code):
            continue
        # AES-CTR, 小端计数器从 1 开始
        ctr = Counter.new(128, initial_value=1, little_endian=True)
        plain = AES.new(dk[:key_size], AES.MODE_CTR, counter=ctr).decrypt(ciphertext)
        return plain, pw
    raise DzipError(f"{name}: AES password verification failed "
                    "(wrong password, or appended byte not in 1..255)")

def extract(data, entries, out_dir, password=None):
    os.makedirs(out_dir, exist_ok=True)
    deferred_dir_modes = []
    aes_pw_cache = None                          # 每包命中的 "密码+字节", 复用
    pw_bytes = password.encode("utf-8") if password else None

    for e in entries:
        target = safe_join(out_dir, e.name)      # 路径穿越防护
        if e.is_dir:
            os.makedirs(target, exist_ok=True)
            if e.host_unix:
                deferred_dir_modes.append((target, e.unix_mode & 0o7777))
            continue

        os.makedirs(os.path.dirname(target), exist_ok=True)
        raw = read_local_data(data, e)

        if e.is_aes:
            if pw_bytes is None:
                raise DzipError(f"{e.name}: AES-encrypted; supply -p")
            # 候选: 缓存命中 -> 原始密码 -> 原始密码+字节 1..255
            cands = []
            if aes_pw_cache is not None:
                cands.append(aes_pw_cache)
            cands.append(pw_bytes)
            cands.extend(pw_bytes + bytes((b,)) for b in range(1, 256))
            raw, used = decrypt_aes(raw, cands, e.aes, e.name)
            aes_pw_cache = used                  # 缓存, 同包后续条目直接命中
            method = e.effective_method          # AES 条目的真实方法在 0x9901 里
        elif e.is_encrypted:
            raise DzipError(f"{e.name}: traditional ZipCrypto not supported")
        else:
            method = e.method

        payload = decompress(raw, method, e.name)

        if len(payload) != e.uncomp_size:
            raise DzipError(f"{e.name}: size mismatch")
        # AE-2 会把 CRC 置零; 此时 HMAC 已鉴权, 跳过 CRC
        if not (e.is_aes and e.aes[3] == 2 and e.crc == 0):
            actual_crc = binascii.crc32(payload) & 0xFFFFFFFF
            if actual_crc != e.crc:
                raise DzipError(f"{e.name}: CRC mismatch")
        with open(target, "wb") as fh:
            fh.write(payload)
        if e.host_unix:
            os.chmod(target, e.unix_mode & 0o7777)

    # 目录权限最后设, 免得 restrictive mode 卡住中间写入
    for target, mode in deferred_dir_modes:
        os.chmod(target, mode)