zip pattern: Improved fallback method for finding eocd #177
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ta to cover this edge case
|
Thank you! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hi :)
I found a bug when I ran the zip pattern on some random zip file I had. In this case it was the zip of the Binwalk 2.3.4 source code. You can verify by download it from github (releases and then download (Source code(zip)). Open with imHex and select zip pattern. It will fail. I created my own zip test data to cover this bug.
The bug is when multiple signatures for the eocd are located in the last 64kb. The fallback will pick the first one, which does not always work when there might be multiple potential eocd signatures within that range.
This pull request fixes that bug and should make the fallback method more reliable. This is done by looping through all eocd signatures within the last 64kb. Invalid "eocd" signatures will be discarded and the correct eocd will be returned.