├── .gitignore
├── 1.png
├── 2.png
├── 3.png
├── LICENSE
├── README.md
├── modify.jar
├── original.jar
└── paddingzip.py


/.gitignore:
--------------------------------------------------------------------------------
1 | /.idea/
2 | 


--------------------------------------------------------------------------------
/1.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/phith0n/PaddingZip/28c9e64054ac5f619823f87546d6f65e4c9d6d9d/1.png


--------------------------------------------------------------------------------
/2.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/phith0n/PaddingZip/28c9e64054ac5f619823f87546d6f65e4c9d6d9d/2.png


--------------------------------------------------------------------------------
/3.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/phith0n/PaddingZip/28c9e64054ac5f619823f87546d6f65e4c9d6d9d/3.png


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2022 phith0n
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # PaddingZip 
 2 | 
 3 | PaddingZip is a tool that you can craft a zip file that contains the padding characters between the file content.
 4 | 
 5 | A normal zip file:
 6 | 
 7 | ![](2.png)
 8 | 
 9 | A craft but valid zip file:
10 | 
11 | ![](3.png)
12 | 
13 | For example, you can craft a valid JAR file using PaddingZip:
14 | 
15 | ![](1.png)
16 | 
17 | ## Usage
18 | 
19 | ```shell
20 | $ python paddingzip.py -h
21 | usage: paddingzip.py [-h] -i INPUT_FILENAME -o OUTPUT_FILENAME [-p PREPEND] [-a APPEND]
22 | 
23 | A tool that you can craft a zip file that contains the padding characters between the file content
24 | 
25 | optional arguments:
26 |   -h, --help            show this help message and exit
27 |   -i INPUT_FILENAME, --input INPUT_FILENAME
28 |   -o OUTPUT_FILENAME, --output OUTPUT_FILENAME
29 |   -p PREPEND, --prepend PREPEND
30 |                         the characters that you want to prepend to the file beginning
31 |   -a APPEND, --append APPEND
32 |                         the characters that you want to append to the file
33 | 
34 | ```
35 | 
36 | For example:
37 | 
38 | ```shell
39 | python paddingzip.py -i original.jar -o modify.jar --prepend "this prepend to the start" --append "this append to the end"
40 | ```
41 | 
42 | ## `zip -F`
43 | 
44 | You also can use `zip -F` to fix the offset:
45 | 
46 | ```shell
47 | $ echo -n "prepend" > f
48 | $ cat f a.zip > b.zip
49 | $ zip -F b.zip --out c.zip
50 | ```
51 | 
52 | ## License
53 | 
54 | MIT License
55 | 


--------------------------------------------------------------------------------
/modify.jar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/phith0n/PaddingZip/28c9e64054ac5f619823f87546d6f65e4c9d6d9d/modify.jar


--------------------------------------------------------------------------------
/original.jar:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/phith0n/PaddingZip/28c9e64054ac5f619823f87546d6f65e4c9d6d9d/original.jar


--------------------------------------------------------------------------------
/paddingzip.py:
--------------------------------------------------------------------------------
  1 | import os
  2 | import argparse
  3 | import io
  4 | import struct
  5 | from typing import Union
  6 | from enum import Enum
  7 | 
  8 | 
  9 | class ZIPTag(Enum):
 10 |     S_ZIPFILERECORD = 0x04034b50
 11 |     S_ZIPDATADESCR = 0x08074b50
 12 |     S_ZIPDIRENTRY = 0x02014b50
 13 |     S_ZIPDIGITALSIG = 0x05054b50
 14 |     S_ZIP64ENDLOCATORRECORD = 0x06064b50
 15 |     S_ZIP64ENDLOCATOR = 0x07064b50
 16 |     S_ZIPENDLOCATOR = 0x06054b50
 17 | 
 18 | 
 19 | class ZIPManipulation(object):
 20 |     def __init__(self, reader: Union[io.BytesIO, bytes], prepend: bytes, append: bytes):
 21 |         if isinstance(reader, bytes):
 22 |             reader = io.BytesIO(reader)
 23 | 
 24 |         self.reader: io.BytesIO = reader
 25 |         self.prepend_table = []
 26 |         self.append_table = []
 27 |         self.prepend = prepend
 28 |         self.prepend_size = len(prepend)
 29 |         self.append = append
 30 |         self.append_size = len(append)
 31 | 
 32 |     def run(self):
 33 |         while True:
 34 |             tag = self.reader.read(4)
 35 |             length = len(tag)
 36 |             if length == 0:
 37 |                 break
 38 |             elif length > 4:
 39 |                 raise Exception('please do not append any bytes to original zip file')
 40 |             elif length < 4:
 41 |                 raise Exception('unsupported type found')
 42 | 
 43 |             n = struct.unpack('<I', tag)
 44 |             self.next(n[0])
 45 | 
 46 |         self.reader.seek(0)
 47 |         data = self.reader.getvalue()
 48 |         for (index, offset) in self.prepend_table:
 49 |             data = data[:index] + struct.pack('<I', offset + self.prepend_size) + data[index + 4:]
 50 | 
 51 |         for (index, size) in self.append_table:
 52 |             data = data[:index] + struct.pack('<H', size + self.append_size) + data[index + 2:]
 53 | 
 54 |         return self.prepend + data + self.append
 55 | 
 56 |     def next(self, tag: int):
 57 |         if tag == ZIPTag.S_ZIPFILERECORD.value:
 58 |             self.zip_filerecord()
 59 |         elif tag == ZIPTag.S_ZIPDATADESCR.value:
 60 |             self.zip_data_descr()
 61 |         elif tag == ZIPTag.S_ZIPDIRENTRY.value:
 62 |             self.zip_direntry()
 63 |         elif tag == ZIPTag.S_ZIPENDLOCATOR.value:
 64 |             self.zip_end_locator()
 65 |         else:
 66 |             raise Exception('does not support this type of zip: %r', tag)
 67 | 
 68 |     def zip_filerecord(self):
 69 |         self.reader.read(14)
 70 |         compressed_size = struct.unpack('<I', self.reader.read(4))[0]
 71 |         self.reader.read(4)
 72 |         filename_size, extra_size = struct.unpack('<HH', self.reader.read(4))
 73 |         self.reader.read(compressed_size + filename_size + extra_size)
 74 | 
 75 |     def zip_data_descr(self):
 76 |         self.reader.read(12)
 77 | 
 78 |     def zip_direntry(self):
 79 |         self.reader.read(24)
 80 |         filename_size, extra_size = struct.unpack('<HH', self.reader.read(4))
 81 |         self.reader.read(10)
 82 |         index = self.reader.tell()
 83 |         offset = struct.unpack('<I', self.reader.read(4))[0]
 84 |         self.reader.read(filename_size + extra_size)
 85 | 
 86 |         self.prepend_table.append((index, offset))
 87 | 
 88 |     def zip_end_locator(self):
 89 |         self.reader.read(12)
 90 |         index = self.reader.tell()
 91 |         offset, comment_size = struct.unpack('<IH', self.reader.read(6))
 92 |         self.reader.read(comment_size)
 93 |         self.prepend_table.append((index, offset))
 94 |         self.append_table.append((index + 4, comment_size))
 95 | 
 96 | 
 97 | def main():
 98 |     parser = argparse.ArgumentParser(
 99 |         description='A tool you can craft a zip file that contains the padding characters between the file content'
100 |     )
101 |     parser.add_argument('-i', '--input', required=True, metavar='INPUT_FILENAME')
102 |     parser.add_argument('-o', '--output', required=True, metavar='OUTPUT_FILENAME')
103 |     parser.add_argument('-p',
104 |                         '--prepend',
105 |                         default='',
106 |                         help='the characters that you want to prepend to the file beginning')
107 |     parser.add_argument('-a',
108 |                         '--append',
109 |                         default='',
110 |                         help='the characters that you want to append to the file')
111 |     args = parser.parse_args()
112 | 
113 |     with open(args.input, 'rb') as f:
114 |         data = f.read()
115 | 
116 |     manipulation = ZIPManipulation(data, args.prepend.encode(), args.append.encode())
117 |     data = manipulation.run()
118 | 
119 |     with open(args.output, 'wb') as f:
120 |         f.write(data)
121 | 
122 |     print('file %r is generated' % args.output)
123 | 
124 | 
125 | if __name__ == '__main__':
126 |     main()
127 | 


--------------------------------------------------------------------------------