zipdetails icon indicating copy to clipboard operation
zipdetails copied to clipboard

Published 20 hours ago • verified publisher icon pmqs

iOS ipa files

Open pmqs opened this issue 3 years ago • 3 comments

These are zip file. Some use compression method 99 to store a payload compressed with LZFSE

Method 99 is already registered in APPNOTE for AES encryption.

May be able to infer LZFSE if it has a signature.

pmqs avatar Jul 13 '21 11:07 pmqs

Sample IPA File, 534.ipa, available at https://sourceforge.net/p/sevenzip/discussion/45797/thread/407a191c4f/

pmqs avatar Jun 27 '22 16:06 pmqs

https://github.com/lzfse/lzfse

pmqs avatar Aug 10 '23 21:08 pmqs

From https://github.com/lzfse/lzfse/blob/master/src/lzfse_internal.h

looks like magic id "bvx"

#define LZFSE_NO_BLOCK_MAGIC             0x00000000 // 0    (invalid)
#define LZFSE_ENDOFSTREAM_BLOCK_MAGIC    0x24787662 // bvx$ (end of stream)
#define LZFSE_UNCOMPRESSED_BLOCK_MAGIC   0x2d787662 // bvx- (raw data)
#define LZFSE_COMPRESSEDV1_BLOCK_MAGIC   0x31787662 // bvx1 (lzfse compressed, uncompressed tables)
#define LZFSE_COMPRESSEDV2_BLOCK_MAGIC   0x32787662 // bvx2 (lzfse compressed, compressed tables)
#define LZFSE_COMPRESSEDLZVN_BLOCK_MAGIC 0x6e787662 // bvxn (lzvn compressed)

pmqs avatar Aug 10 '23 21:08 pmqs