Author Topic: FCrackZip  (Read 1078 times)

André Heldoorn

  • Full Member
  • ***
  • Thank You
  • -Given: 37
  • -Receive: 8
  • Posts: 235
    • View Profile
FCrackZip
« on: April 07, 2017, 06:28:00 pm »
http://oldhome.schmorp.de/marc/data/fcrackzip-1.0.tar.gz seems to be protected by a password. A programmer's joke? https://github.com/hyc/fcrackzip may be an alternative source.

Quote
- many compatibility enhancements and bugfixes suggested by Robert Meszaros.
- various small bugfixes noted by Jeff LaMarche and Max Alekseyev.
- updated to current gcc, autoconf, automake.
- added a TARGET_CPU=0 mode, for the C-only version.

It's possible to use a space in Zip 2.32's passwords, but the older FCrackZip (v0.2.4) doesn't support this. Test case:

zip -e test.zip c:\config (enter the password "a b", 3 characters)
fcrackzip -v --length 3-3 test.zip (verbose, known length is 3 characters)

It it's easy to test if a password with spaces is supported ("many compatibility enhancements"), then can someone please try that? If it's too hard, or it still doesn't support a space, then it's probably not worth a release. I don't need it at the moment, I just gave it a try with a stable Zip/2 version and noticed it didn't work.

Please note that the long "possible pw found"-list is not the problem. The problem is that the list doesn't contain any space, and the argument -p a b won't work (nor -p "a b").



Andreas Kohl

  • Full Member
  • ***
  • Thank You
  • -Given: 6
  • -Receive: 9
  • Posts: 210
    • View Profile
    • warpserver.de
Re: FCrackZip
« Reply #1 on: April 07, 2017, 10:09:00 pm »
http://oldhome.schmorp.de/marc/data/fcrackzip-1.0.tar.gz seems to be protected by a password. A programmer's joke?

Neither tar nor gzip can use password protection. You're quite late for 1st of April.

André Heldoorn

  • Full Member
  • ***
  • Thank You
  • -Given: 37
  • -Receive: 8
  • Posts: 235
    • View Profile
Re: FCrackZip
« Reply #2 on: April 09, 2017, 10:43:14 pm »
7z x fcrackzip-1.0.tar.gz
7z x fcrackzip-1.0.tar
unzip fcrackzip-1.0 (as such no ZIP file, looks like a damaged text file, results quoted below):

Code: [Select]
Archive:  fcrackzip-1.0
warning [fcrackzip-1.0]:  432128 extra bytes at beginning or within zipfile
  (attempting to process anyway)
[fcrackzip-1.0] TEXT1.TXT password:

It may be some Unix archive type, but it's a fact that fcrackzip-1.0 asks for a TEXT1.TXT password... :o

Dave Yeo

  • Hero Member
  • *****
  • Thank You
  • -Given: 8
  • -Receive: 91
  • Posts: 1174
    • View Profile
Re: FCrackZip
« Reply #3 on: April 10, 2017, 12:33:05 am »
gzip -d fcrackzip-1.0.tar.gz && tar x fcrackzip-1.0.tar or tar xvfz fcrackzip-1.0.tar.gz is closer to the correct command. I opened the archive with no problem here, built fine as well. Seems to have the same lack of space support as you mentioned.

André Heldoorn

  • Full Member
  • ***
  • Thank You
  • -Given: 37
  • -Receive: 8
  • Posts: 235
    • View Profile
Re: FCrackZip
« Reply #4 on: April 10, 2017, 01:09:51 am »
LOL, so there's no password... :P

I guess the new version isn't really worth releasing then. Support for spaces is a missing feature (or perhaps even an Info-ZIP bug), instead of the old FCrackZip not being up-to-date with our Zip 2.32+ & UnZip 5.52+ passwords anymore.

Let's remember that using a space in a ZIP password makes it slightly harder to guess the password, for one because not all crackers do support spaces in a ZIP file's password.

Andreas Kohl

  • Full Member
  • ***
  • Thank You
  • -Given: 6
  • -Receive: 9
  • Posts: 210
    • View Profile
    • warpserver.de
Re: FCrackZip
« Reply #5 on: April 10, 2017, 02:29:02 am »

Code: [Select]
Archive:  fcrackzip-1.0
warning [fcrackzip-1.0]:  432128 extra bytes at beginning or within zipfile
  (attempting to process anyway)
[fcrackzip-1.0] TEXT1.TXT password:

It may be some Unix archive type, but it's a fact that fcrackzip-1.0 asks for a TEXT1.TXT password... :o
The archive is definitely not an "Unix archive type". You should better distingiush between archive and compression. In fact gzip is neither UNIX nor an archiver. The only "special" about the mentioned compressed file is the usage of gzip option "-n" for its creation. There's simply no UCT timestamp and no filename in the header.

Under UNIX usually cpio is used for archiving and compress or pack for the compression of it, that would result in *.cpio.Z or *.cpio.z filenames.

André Heldoorn

  • Full Member
  • ***
  • Thank You
  • -Given: 37
  • -Receive: 8
  • Posts: 235
    • View Profile
Re: FCrackZip
« Reply #6 on: April 10, 2017, 11:59:41 am »
You should better distingiush between archive and compression.

I did, hence the (unquoted) "may be" and "some", with a matching level/lack of accuracy. :8

gzip is available for many OSes, but on its own *.tar.gz looks like a typical, over-engineered UNIX solution to me. Until now I've never needed a *.tar file (nor really wanted the OS/2 equivalent of an uncompressed archive), and used one UNTGZOS2.EXE (instead of executing 7z twice) to get rid of both the gz and tar part.

Please note that I don't have eCS 2.x with all of its UNIX tools, nor a GCC environment (will cause disk full errors), nor have I ever intentionally used the GZIP of eCS 1.x. So remarks w.r.t the option and cpio are, to say the least, interesting. I almost want to ask why cpio is usually used instead of a (tape-unrelated?) tar, but perhaps that's too off-topic.

Andreas Kohl

  • Full Member
  • ***
  • Thank You
  • -Given: 6
  • -Receive: 9
  • Posts: 210
    • View Profile
    • warpserver.de
Re: FCrackZip
« Reply #7 on: April 10, 2017, 06:13:58 pm »
gzip is available for many OSes, but on its own *.tar.gz looks like a typical, over-engineered UNIX solution to me.
gzip is not UNIX - it's GNU. It doesn't care about tar or anything else. It simply does compression in most cases.

Quote
Until now I've never needed a *.tar file (nor really wanted the OS/2 equivalent of an uncompressed archive), and used one UNTGZOS2.EXE (instead of executing 7z twice) to get rid of both the gz and tar part.
Otherwise tar is an UNIX command. The file format was specified in IEEE P1003.1. But only POSIX.1-2001 (pax) allows longer pathnames, charset coding etc. I doubt that old untgz will handle it reliably. There should be a port of star available that should be a better solution.

Quote
Please note that I don't have eCS 2.x with all of its UNIX tools, nor a GCC environment (will cause disk full errors), nor have I ever intentionally used the GZIP of eCS 1.x. So remarks w.r.t the option and cpio are, to say the least, interesting. I almost want to ask why cpio is usually used instead of a (tape-unrelated?) tar, but perhaps that's too off-topic.
The gzip ports for OS/2 are outdated and should only be used on HPFS volumes to avoid problems. Old tar has a pathname length limitation, but that's only one reason for cpio. Newer tar implementations like later GNU tar versions or star can do more of course. EAs and ACLs are another problem https://github.com/libarchive/libarchive/wiki/TarExtendedAttributes.

André Heldoorn

  • Full Member
  • ***
  • Thank You
  • -Given: 37
  • -Receive: 8
  • Posts: 235
    • View Profile
Re: FCrackZip
« Reply #8 on: April 15, 2017, 12:33:27 pm »
Quote
gzip is not UNIX - it's GNU. It doesn't care about tar or anything else. It simply does compression in most cases.

And DIR isn't OS/2. It's an Unix solution. I, not being an Unix benchmark by any standard, have seen more tar.gz files than gz files and could have suggested gar or zar, I was referring to "The program was created ... as a free software replacement for the compress program used in early Unix systems". The best source ever, Wikipedia ;)

Quote
I doubt that old untgz will handle it reliably.

Typically I'm looking at older packages, but thanks for pointing such a possible problem out. For more modern (source) packages you'll often need libs and GCC. probably with a more up-to-date Unix-environment.

Back to FCrackZip. Recently I've looked at password specifications file. A change is not as trivial as appending a space to the list of allowed password characters. Some of the other (unverified) password characters are TAB and LF, so the way FCrackZip prints possible passwords has to be changed too. Yet another reason to not release an update. The old version will already guess most common passwords anyway, without those more unusual password characters, including but not limited to a space.