仅当我传递 "zipfile.BadZipFile: Bad CRC-32"作为密码时，Python 才会抛出 "D"

Question

我正在尝试创建一个 Python 脚本来测试受密码保护的 zip 文件的密码。唯一的问题是，每当我尝试专门传递“D”作为密码时，我都会得到 zipfile.BadZipFile: Bad CRC-32'

为了测试它，我创建了 p.zip，密码为 p，只有一个名为 p.txt 的文件，并运行了这个代码:

from zipfile import ZipFile

with ZipFile("p.zip") as zf:
    password = "E"
    try:
        zf.extractall(pwd=bytes(password, "utf-8"))
    except RuntimeError:
        print("wrong password: " + password)

我刚刚得到错误的密码:E，这正是我所期望的。

但是，当我运行完全相同的代码(除了 password = "D" 之外)时，我得到 zipfile.BadZipFile: Bad CRC-32 for file 'p.txt'

我尝试了几个字符串，例如p、letmein、password1、DD、DDD 它们都工作正常。仅设置 password = "D" 会给出 zipfile.BadZipFile: Bad CRC-32 for file 'p.txt'。

有人知道这个问题的原因或可能的解决办法吗？

这是控制台上的完整错误:

Traceback (most recent call last):
  File "C:/Users/argolis/workspace/zip-breaker/zip-breaker/script2.py", line 6, in <module>
    zf.extractall(pwd=bytes(password, "utf-8"))
  File "C:\Users\argolis\AppData\Local\Programs\Python\Python37\lib\zipfile.py", line 1594, in extractall
    self._extract_member(zipinfo, path, pwd)
  File "C:\Users\argolis\AppData\Local\Programs\Python\Python37\lib\zipfile.py", line 1649, in _extract_member
    shutil.copyfileobj(source, target)
  File "C:\Users\argolis\AppData\Local\Programs\Python\Python37\lib\shutil.py", line 79, in copyfileobj
    buf = fsrc.read(length)
  File "C:\Users\argolis\AppData\Local\Programs\Python\Python37\lib\zipfile.py", line 876, in read
    data = self._read1(n)
  File "C:\Users\argolis\AppData\Local\Programs\Python\Python37\lib\zipfile.py", line 966, in _read1
    self._update_crc(data)
  File "C:\Users\argolis\AppData\Local\Programs\Python\Python37\lib\zipfile.py", line 894, in _update_crc
    raise BadZipFile("Bad CRC-32 for file %r" % self.name)
zipfile.BadZipFile: Bad CRC-32 for file 'p.txt'

Answer 1

这是解压缩协议(protocol)的预期行为。有时无效的密码会通过密码检查并被CRC检查发现。来自 man unzip (Linux 文档，但算法与平台无关):

The correct password will always check out against the header, but there is a 1-in-256 chance that an incorrect password will as well. (This is a security feature of the PKWARE zipfile format; it helps prevent brute-force attacks that might otherwise gain a large speed advantage by testing only the header.) In the case that an incorrect password is given but it passes the header test anyway, either an incorrect CRC will be generated for the extracted data or else unzip will fail during the extraction because the ``decrypted'' bytes do not constitute a valid compressed data stream.

有一个Python bug report讨论这个问题的地方。