zipography 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 1827f4d1fd43192ac37e029981ab04de876a87d8a9e91b044873d671de1738cc
+  data.tar.gz: c2de37c58542aca50915c71712cda9f420cc2dded28cf95a9af1c369465774f7
+SHA512:
+  metadata.gz: 960794c6d6a3cdb205c54e4b9ef1c38d840ca061e6fd547340c1122c88310312a19f2ff40e481a01d365bc8e76076fe01ee6d8a1fe25e243ce7e086c271fd24a
+  data.tar.gz: 381072f98336e90d7dc953821a7c5812cf736b09a0f19216915acdd5c82a498e7fb1f4e4c911c2519f8222484a26305fbd1becac4ee9fa15907adc61c2a00b66

data/README.md

@@ -0,0 +1,78 @@
+# Zipography
+
+Steganography with zip archives: hide a blob of data within an
+archive. For typical file archivers (7-zip, WinRAR, File Roller, &c) or
+file managers (Windows Explorer), the blob is invisible.
+
+    $ gem install zipography
+
+Limitations:
+
+* single blob only (but you can just add another .zip as a blob);
+* doesn't work w/ zip64 files (this means 4GB max for an archive+blob
+  combo);
+* corrupts zip spec v6.2+ files that use *central directory*
+  encryption;
+* memory hungry, for it's just a toy, not a serious spy tool.
+
+## Usage
+
+Say we have a .zip that contains 2 files:
+
+~~~
+$ du orig.zip
+12K     orig.zip
+
+$ bsdtar tf orig.zip
+The Celebrated Jumping Frog of Calaveras County.txt
+What You Want.txt
+~~~
+
+Inject a picture into the archive:
+
+    $ zipography-inject orig.zip blob1.png > 1.zip
+
+It it visible? No:
+
+~~~
+$ bsdtar tf 1.zip
+The Celebrated Jumping Frog of Calaveras County.txt
+What You Want.txt
+
+$ du 1.zip
+30K     1.zip
+~~~
+
+(`unzip -l` prints the same, but in a much verbose form.)
+
+Check if we have the picture in the archive:
+
+~~~
+$ zipography-info 1.zip
+Payload size:    18313
+Adler32:         0x6812d9f
+Version:         1
+Valid:           true
+~~~
+
+Extract it:
+
+~~~
+$ zipography-extract 1.zip > 1.png
+$ xdg-open !$
+~~~
+
+<img src='test/blob1.png'>
+
+## How does it work?
+
+A blob is injected after a file section right before the 1st *central
+directory header*. After that, a pointer in an *end of central
+directory* record is updated to compensate the shift of the *central
+directory header*.
+
+<img src='doc/zip.svg'>
+
+## License
+
+MIT.

data/lib.rb

@@ -0,0 +1,80 @@
+require 'zlib'
+require 'bindata'
+
+module Zipography
+
+  HEADER_SIZE = 9               # bytes
+  class HiddenBlob < BinData::Record
+    endian :little
+
+    uint32 :checksum
+    uint32 :len
+    uint8 :version, initial_value: 1
+  end
+
+  def checksum s; Zlib.adler32(s); end
+
+  def blob_make file
+    payload = File.read file
+    header = HiddenBlob.new len: File.stat(file).size,
+                            checksum: checksum(payload)
+    [payload.force_encoding('ASCII-8BIT'), header.to_binary_s].join
+  end
+
+  class MyZip
+    def initialize file
+      @file = file
+      @buf = File.read file
+      @eocd = end_of_central_dir
+      @first_cdh = first_central_dir_header
+    end
+
+    def first_central_dir_header
+      @buf.index [0x02014b50].pack('V')
+    end
+
+    def end_of_central_dir
+      pos = @buf.rindex [0x06054b50].pack('V')
+      fail 'not a zip file' unless pos
+      pos
+    end
+
+    # start of central dir offset
+    def offset
+      @buf.slice(@eocd+16, 4).unpack('V').first
+    end
+
+    # very crude: instead of an intelligent parsing of eocd, modifying
+    # an offset, replacing eocd, we just change the offset. this won't
+    # fly for zip64 files
+    def repack data
+      [
+        @buf.slice(0, @first_cdh),
+        data,
+        # just before the offset of start of central dir
+        @buf.slice(@first_cdh, (@eocd+16) - @first_cdh),
+        # inject new offset
+        [offset + data.bytesize].pack('V'),
+        # the rest
+        @buf.slice(@eocd+16+4, @buf.size)
+      ]
+    end
+
+    def blob
+      payload = ''
+      header = {}
+      File.open(@file) do |f|
+        f.seek(offset-HEADER_SIZE)
+        header = HiddenBlob.read f
+        f.seek(offset-HEADER_SIZE-header.len)
+        payload = f.read header.len
+      end
+      { header: header, payload: payload }
+    end
+
+    def payload_valid? blob
+      blob[:header][:checksum] == checksum(blob[:payload])
+    end
+  end
+
+end

data/zipography-extract

@@ -0,0 +1,8 @@
+#!/usr/bin/env ruby
+
+require_relative './lib'
+include Zipography
+
+z = MyZip.new ARGV[0]
+blob = z.blob
+z.payload_valid?(blob) ? $stdout.write(blob[:payload]) : exit(1)

data/zipography-info

@@ -0,0 +1,12 @@
+#!/usr/bin/env ruby
+
+require_relative './lib'
+include Zipography
+
+z = MyZip.new ARGV[0]
+blob = z.blob
+
+puts "Payload size:    #{blob[:header][:len]}"
+puts "Adler32:         0x" + blob[:header][:checksum].to_i.to_s(16)
+puts "Version:         #{blob[:header][:version]}"
+puts "Valid:           #{z.payload_valid?(blob)}"

data/zipography-inject

@@ -0,0 +1,10 @@
+#!/usr/bin/env ruby
+
+require_relative './lib'
+include Zipography
+
+abort "Usage: #{File.basename __FILE__} old.zip blob > new.zip" if ARGV.size < 2
+
+z = MyZip.new ARGV[0]
+data = blob_make ARGV[1]
+z.repack(data).each {|buf| $stdout.write buf }

metadata

@@ -0,0 +1,70 @@
+--- !ruby/object:Gem::Specification
+name: zipography
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Alexander Gromnitsky
+autorequire: 
+bindir: "."
+cert_chain: []
+date: 2020-08-22 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bindata
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.4.8
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.4.8
+description: |
+  Steganography with zip archives: hide a blob of data within an
+  archive. For typical file archivers or file managers, the blob remains
+  invisible.
+email: alexander.gromnitsky@gmail.com
+executables:
+- zipography-extract
+- zipography-info
+- zipography-inject
+extensions: []
+extra_rdoc_files: []
+files:
+- "./zipography-extract"
+- "./zipography-info"
+- "./zipography-inject"
+- README.md
+- lib.rb
+- zipography-extract
+- zipography-info
+- zipography-inject
+homepage: https://github.com/gromnitsky/zipography
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.4.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.1.2
+signing_key: 
+specification_version: 4
+summary: Steganography with zip archives
+test_files: []