2

I have several files that a 3rd party program generated that have a .zip extension, however neither windows nor 7-Zip can extract it. In 7-Zip it does show me the file name of the uncompressed file however when I try to extract it I get the error

An attempt was made to move the file pointer before the beginning of the file.

I ran the file through TrID.NET, however it had not even a partial match on what the file was.

Here is the fist 51 bytes of the file.

offset: 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50
   hex: 14 00 08 00 08 00 C2 43 C6 3E 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 31 30 35 36 30 36 2D 32 30 31 31 30 36 30 33 31 33 34 31 34 36 2E 65 6E 63
 ascii: .  .  .  .  .  .  .  C  .  >  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  1  0  5  6  0  6  -  2  0  1  1  0  6  0  3  1  3  4  1  4  6  .  e  n  c

Here are the things I have figured out looking at severial files and comparing the headers:

  • Bytes 0-5 are always 14 00 08 00 08 00 in the examples I checked
  • Bytes 6-9 change per file, I don't think it is the uncompressed file size as it is much to big.
  • Bytes 10-21 are always 00 in the examples I checked
  • Bytes 22-25 is the length of the filename of the compressed file.
  • Bytes 26-50 is the compressed file name (105606-20101020162359.enc in this example)

Everything after the file name appears to be different per compressed file.

Does anyone know what this fileformat is?

1
  • I wonder if it's not a regular .ZIP file with the headers intentionally mangled as a form of protection? Have you tried running any "ZIP File Repair" tools on the archive? They might be able to rebuild the directory, find the data, and extract the files.
    – afrazier
    Aug 3, 2012 at 16:50

1 Answer 1

3

I did some searching, and it appears that it might be a .JAR.

A .JAR's identifier is: 50 4B 03 04 14 00 08 00 08 00 (source, search for JAR)

Which is the only partial match I could find.

This could also explain why you can't read it; part of the identifier is missing.

4
  • Even so, 7zip (and windows) have no trouble with JAR, so I don't know. If it is a .JAR what can I use to extract it? Aug 3, 2012 at 16:48
  • You sir, are a genius, I used a hex editor to add in the missing 50 4B 03 04 and 7zip extracted the file. Aug 3, 2012 at 16:50
  • Google is the actual genius here :) But thank you for the nice words! Aug 3, 2012 at 17:02
  • In case anyone was curious, after hooking Process Monitor to the program I found out that it was calling zip.dll from the Java SE Runtime, so that explains the .JAR connection! Aug 17, 2012 at 21:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .