I was asked for help with a problem similar to the following.

Here is a ZIP file, analyzed with zipdump.py:

The filename you see, is in Simplified Chinese:

zipdump.py relies on the zipfile or pyzipper Python modules to parse the given ZIP file, and have the metadata (filenames and comments) decoded correctly.

If this ZIP file would be corrupt or malformed, so that it can not be parsed by these Python modules, then you can still try to use zipdump -f option to locate individual ZIP records:

As I don't know which encoding has been used for the metadata (filenames and comments), I display the filename as a Python byte string and not as a string. If the filename is simple ASCII, it will be readable (like the extension .vir here), but if it is utf-8, for example Simplified Chinese, then you'll just see hexadecimal values.

And that is why I added a new option: --metadata_encoding. With this new option, you can specify a codec, that will be used to convert bytes into strings when option -f is used. Like this:

So here I use codec utf-8, because the filename is encoded in utf-8. How do I know this? Well, in the ZIP specification, the metadata is either ASCII (CP437 to be precise) or UTF-8 encoded. So when you check the flags, you'll know which encoding to use:

Flag 0x0800 means that encoding utf-8 is used. I've also added a feature that decodes the flag bits into readable text, as can be seen in the screenshot above.

If you specify another codec, like latin, for this specific ZIP file, the filenames will be decoded incorrectly:

Option --metadata_encoding can also be used when you don't use option -f, however, module pyzipper does not support this (there's a PR) and in module zipfile the flags take precedence.

Didier Stevens

Senior handler

blog.DidierStevens.com