Hacker News Reader

Comment by fendy3002 | Hacker News Reader

The fact that merging zip files with cat and do not produce error is amazing by itself. Now we'll wait until someone find / use a way to distribute hidden files using this method.

View on HN

What will really blow your mind is that you can cat a png and a zip together and the resulting file is both a valid png that looks identical to the image and a zip that contains the same contents as the archive.

Mind. Blown. Only works if the PNG is first and the ZIP second though, because PNG reads front to back and ZIP reads back to front.

This is how these self extracting archives work, it’s just an exe (that allows adding random data to the end) and a zip (that allows random data to be prepended) added together.

more specifically the executable part contains the logic to decompress the remainder of the file, while still allowing a decompression program to be able to open and decompress the file (ignoring the executable portion of that file).

You might enjoy PoC||GTFO issue #10:

> The polyglot file pocorgtfo10.pdf is valid as a PDF, as a ZIP file, and as an LSMV recording of a Tool Assisted Speedrun (TAS) that exploits Pokémon Red in a Super GameBoy on a Super NES. The result of the exploit is a chat room that plays the text of PoCkGTFO 10:3.

https://www.alchemistowl.org/pocorgtfo/pocorgtfo10.pdf

This may be also the trick used by the fantasy console PICO-8[0] which games run by png-based cartridges[1].

[0]: https://www.lexaloffle.com/pico-8.php

[1]: https://www.lexaloffle.com/bbs/?cat=7&carts_tab=1#sub=2&mode...

Apparently, Pico8 encodes the compressed app data directly in the PNG pixel data. They use 2 least significant bits of each color channel to encode a single byte of data per color. The pixel count of pico8 cartridges is what creates the console's 32,800 byte size limit.

https://pico-8.fandom.com/wiki/P8PNGFileFormat

> Now we'll wait until someone find / use a way to distribute hidden files using this method.

You mean like the GIFAR attack (https://en.wikipedia.org/wiki/GIFAR)?

Back in the day people used to spread zips hidden in jpegs on imageboards using basically the same idea (after the jpg data is the zip data)

The most iconic /i/ kit spread this way being Dangerous Kitten (https://web.archive.org/web/20120322025258/http://partyvan.i...)

This is what the original SFX self-executable extractor use. Appends a zip file to a extractor exe.

This is also why traditionally zip are read from backwards.

> Now we'll wait until someone find / use a way to distribute hidden files using this method.

No need to wait. Microsoft does this in their file formats. (E.g., PowerBI's pbix files have this pattern.)

A lot of software installers use this method. It’s a very old tried and true method.

You may enjoy the PoC || GTFO ("Proof of Concept or Get The Fuck Out", google) "newsletter", which is a pdf and zip in a single file, sometimes with a some other file types merged in, too (e.g. truecrypt), and which also contains back issues in the current issue, russian-doll-style.

Reply on news.ycombinator.com