Repository navigation
Attack of specific deflate file types #163
Description
I have at least 15 zip archives, each encrypted with ZipCrypto and a strong password; each containing only "deflate" files (not a single "store" file), compressed with 7zip - compression level 5.
Archives typically contain multiple .xlsx files, sized 5 - 20 kb, and one large .zip file, sized 100 Mb - 4 Gb. I don't have decrypted versions of any of the files in the archives, nor can they be obtained, but I do have .xlsx and .zip files with similar content (.xlsx with identical formatting, column names, etc; .zip files compressed with identical process).
Is there an attack vector that has any realistic chance of success for such situation? Is there a chance that same compression algorithm of similar file would yield usable bytes for attack (is there a predictable result of deflate compression when applied to the large .zip files, or .xlsx files with repetitive elements)?
Activity
kimci86 commentedon Jul 19, 2026
I cannot guarantee this will work, but with a bit of luck, it could be possible.
Here is what I would try:
This can be done using a combination of zipdetails to get offset/length of deflate stream in archive and
ddto dump a slice of data, or an hexadecimal editor. (or bkcrack eventually, see Extracting deflated file from unencrypted zip #93)You can use an hexadecimal editor and/or infgen for that.
If you need more help and don't mind sharing your files with the internet, you can upload them here so I and others could have a look.
You can also email them to me if you want a little more privacy.
I hope it helps.