📄 extra.fld
字号:
Value Size Description ----- ---- ----------- (Patch) 0x000f Short Tag for this "extra" block type TSize Short Size of the total "extra" block Version Short Version of the descriptor Flags Long Actions and reactions (see below) OldSize Long Size of the file about to be patched OldCRC Long 32-bit CRC of the file about to be patched NewSize Long Size of the resulting file NewCRC Long 32-bit CRC of the resulting file Actions and reactions Bits Description ---- ---------------- 0 Use for autodetection 1 Treat as selfpatch 2-3 RESERVED 4-5 Action (see below) 6-7 RESERVED 8-9 Reaction (see below) to absent file 10-11 Reaction (see below) to newer file 12-13 Reaction (see below) to unknown file 14-15 RESERVED 16-31 RESERVED Actions Action Value ------ ----- none 0 add 1 delete 2 patch 3 Reactions Reaction Value -------- ----- ask 0 skip 1 ignore 2 fail 3 -PKCS#7 Store for X.509 Certificates: =================================== This field is contains the information about each certificate a file is signed with. This field should only appear in the first central directory record, and will be ignored in any other record. Note: all fields stored in Intel low-byte/high-byte order. Value Size Description ----- ---- ----------- (Store) 0x0014 2 bytes Tag for this "extra" block type SSize 2 bytes Size of the store data SData (variable) Data about the store SData Value Size Description ----- ---- ----------- Version 2 bytes Version number, 0x0001 for now StoreD (variable) Actual store data The StoreD member is suitable for passing as the pbData member of a CRYPT_DATA_BLOB to the CertOpenStore() function in Microsoft's CryptoAPI. The SSize member above will be cbData + 6, where cbData is the cbData member of the same CRYPT_DATA_BLOB. The encoding type to pass to CertOpenStore() should be PKCS_7_ANS_ENCODING | X509_ASN_ENCODING. -X.509 Certificate ID and Signature for individual file: ====================================================== This field contains the information about which certificate in the PKCS#7 Store was used to sign the particular file. It also contains the signature data. This field can appear multiple times, but can only appear once per certificate. Note: all fields stored in Intel low-byte/high-byte order. Value Size Description ----- ---- ----------- (CID) 0x0015 2 bytes Tag for this "extra" block type CSize 2 bytes Size of Method Method (variable) Method Value Size Description ----- ---- ----------- Version 2 bytes Version number, for now 0x0001 AlgID 2 bytes Algorithm ID used for signing IDSize 2 bytes Size of Certificate ID data CertID (variable) Certificate ID data SigSize 2 bytes Size of Signature data Sig (variable) Signature data CertID Value Size Description ----- ---- ----------- Size1 4 bytes Size of CertID, should be (IDSize - 4) Size1 4 bytes A bug in version one causes this value to appear twice. IssSize 4 bytes Issuer data size Issuer (variable) Issuer data SerSize 4 bytes Serial Number size Serial (variable) Serial Number data The Issuer and IssSize members are suitable for creating a CRYPT_DATA_BLOB to be the Issuer member of a CERT_INFO struct. The Serial and SerSize members would be the SerialNumber member of the same CERT_INFO struct. This struct would be used to find the certificate in the store the file was signed with. Those structures are from the MS CryptoAPI. Sig and SigSize are the actual signature data and size generated by signing the file with the MS CryptoAPI using a hash created with the given AlgID. -X.509 Certificate ID and Signature for central directory: ======================================================== This field contains the information about which certificate in the PKCS#7 Store was used to sign the central directory. It should only appear with the first central directory record, along with the store. The data structure is the same as the CID, except that SigSize will be 0, and there will be no Sig member. This field is also kept after the last central directory record, as the signature data (ID 0x05054b50, it looks like a central directory record of a different type). This second copy of the data is the Signature Data member of the record, and will have a SigSize that is non-zero, and will have Sig data. Note: all fields stored in Intel low-byte/high-byte order. Value Size Description ----- ---- ----------- (CDID) 0x0016 2 bytes Tag for this "extra" block type CSize 2 bytes Size of Method Method (variable) -ZIP64 Extended Information Extra Field: ====================================== The following is the layout of the ZIP64 extended information "extra" block. If one of the size or offset fields in the Local or Central directory record is too small to hold the required data, a ZIP64 extended information record is created. The order of the fields in the ZIP64 extended information record is fixed, but the fields will only appear if the corresponding Local or Central directory record field is set to 0xFFFF or 0xFFFFFFFF. Note: all fields stored in Intel low-byte/high-byte order. Value Size Description ----- ---- ----------- (ZIP64) 0x0001 2 bytes Tag for this "extra" block type Size 2 bytes Size of this "extra" block Original Size 8 bytes Original uncompresseed file size Compressed Size 8 bytes Size of compressed data Relative Header Offset 8 bytes Offset of local header record Disk Start Number 4 bytes Number of the disk on which this file starts This entry in the Local header must include BOTH original and compressed file sizes. -Extended Timestamp Extra Field: ============================== The following is the layout of the extended-timestamp extra block. (Last Revision 19970118) Local-header version: Value Size Description ----- ---- ----------- (time) 0x5455 Short tag for this extra block type ("UT") TSize Short total data size for this block Flags Byte info bits (ModTime) Long time of last modification (UTC/GMT) (AcTime) Long time of last access (UTC/GMT) (CrTime) Long time of original creation (UTC/GMT) Central-header version: Value Size Description ----- ---- ----------- (time) 0x5455 Short tag for this extra block type ("UT") TSize Short total data size for this block Flags Byte info bits (refers to local header!) (ModTime) Long time of last modification (UTC/GMT) The central-header extra field contains the modification time only, or no timestamp at all. TSize is used to flag its presence or absence. But note: If "Flags" indicates that Modtime is present in the local header field, it MUST be present in the central header field, too! This correspondence is required because the modification time value may be used to support trans-timezone freshening and updating operations with zip archives. The time values are in standard Unix signed-long format, indicating the number of seconds since 1 January 1970 00:00:00. The times are relative to Coordinated Universal Time (UTC), also sometimes referred to as Greenwich Mean Time (GMT). To convert to local time, the software must know the local timezone offset from UTC/GMT. The lower three bits of Flags in both headers indicate which time- stamps are present in the LOCAL extra field: bit 0 if set, modification time is present bit 1 if set, access time is present bit 2 if set, creation time is present bits 3-7 reserved for additional timestamps; not set Those times that are present will appear in the order indicated, but any combination of times may be omitted. (Creation time may be present without access time, for example.) TSize should equal (1 + 4*(number of set bits in Flags)), as the block is currently defined. Other timestamps may be added in the future. -Info-ZIP Unix Extra Field (type 1): ================================== The following is the layout of the old Info-ZIP extra block for Unix. It has been replaced by the extended-timestamp extra block (0x5455) and the Unix type 2 extra block (0x7855). (Last Revision 19970118) Local-header version: Value Size Description ----- ---- ----------- (Unix1) 0x5855 Short tag for this extra block type ("UX") TSize Short total data size for this block AcTime Long time of last access (UTC/GMT) ModTime Long time of last modification (UTC/GMT) UID Short Unix user ID (optional) GID Short Unix group ID (optional) Central-header version: Value Size Description ----- ---- ----------- (Unix1) 0x5855 Short tag for this extra block type ("UX") TSize Short total data size for this block AcTime Long time of last access (GMT/UTC) ModTime Long time of last modification (GMT/UTC) The file access and modification times are in standard Unix signed- long format, indicating the number of seconds since 1 January 1970 00:00:00. The times are relative to Coordinated Universal Time (UTC), also sometimes referred to as Greenwich Mean Time (GMT). To convert to local time, the software must know the local timezone offset from UTC/GMT. The modification time may be used by non-Unix systems to support inter-timezone freshening and updating of zip archives. The local-header extra block may optionally contain UID and GID info for the file. The local-header TSize value is the only indication of this. Note that Unix UIDs and GIDs are usually specific to a particular machine, and they generally require root access to restore. This extra field type is obsolete, but it has been in use since mid-1994. Therefore future archiving software should continue to support it. Some guidelines: An archive member should either contain the old "Unix1" extra field block or the new extra field types "time" and/or "Unix2". If both the old "Unix1" block type and one or both of the new block types "time" and "Unix2" are found, the "Unix1" block should be considered invalid and ignored. Unarchiving software should recognize both old and new extra field block types, but the info from new types overrides the old "Unix1" field. Archiving software should recognize "Unix1" extra fields for timestamp comparison but never create it for updated, freshened or new archive members. When copying existing members to a new archive, any "Unix1" extra field blocks should be converted to the new "time" and/or "Unix2" types. -Info-ZIP Unix Extra Field (type 2):⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -