arrow_backUS Cyber Games 2026
Forensicsmedium

Broken Envelope

by Pavel Knespl (capyplivl)

A ZIP archive (archive.zip) whose End of Central Directory (EOCD) record is missing. The file ends right after the two central-directory headers (PK\x01\x02) with no PK\x05\x06 EOCD, so unzip/zipinfo refuse to read it. The local file data is intact, so the files recover once the EOCD is rebuilt. One file holds a base64 tag with the flag.

Solve

  1. Confirm the damage. unzip -l archive.zip reports "End-of-central-directory signature not found", and a hexdump shows two PK\x01\x02 central-directory entries but no trailing PK\x05\x06:
xxd archive.zip | tail -8
  1. Quick path: 7z reads the local headers directly and pulls both files out despite the error:
7z x archive.zip

Robust path matching the hint (rebuild the EOCD, then standard unzip works). Save as rebuild_eocd.py:

#!/usr/bin/env python3
import struct
data = bytearray(open("archive.zip", "rb").read())
cd_start = data.find(b"PK\x01\x02")
count, pos = 0, cd_start
while pos < len(data) and data[pos:pos+4] == b"PK\x01\x02":
    count += 1
    n = struct.unpack_from("<H", data, pos + 28)[0]
    m = struct.unpack_from("<H", data, pos + 30)[0]
    k = struct.unpack_from("<H", data, pos + 32)[0]
    pos += 46 + n + m + k
cd_size = pos - cd_start
eocd = struct.pack("<IHHHHIIH", 0x06054b50, 0, 0, count, count, cd_size, cd_start, 0)
open("fixed.zip", "wb").write(bytes(data[:pos]) + eocd)
print(f"{count} entries, cd at {cd_start}, size {cd_size}; wrote fixed.zip")
python3 rebuild_eocd.py
unzip fixed.zip -d out
  1. Either path recovers readme.txt and project_dispatch.txt. The dispatch file holds a tag value:
U1ZJVVNDR3tibHVlbW91bnRhaW5femlwX2VvY2RfcmVidWlsZH0=
  1. Decode it:
echo U1ZJVVNDR3tibHVlbW91bnRhaW5femlwX2VvY2RfcmVidWlsZH0= | base64 -d

Flag: SVIUSCG{bluemountain_zip_eocd_rebuild}