View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0000661 | file | General | public | 2025-05-28 11:57 | 2025-05-30 14:00 |
| Reporter | silver | Assigned To | christos | ||
| Priority | normal | Severity | feature | Reproducibility | N/A |
| Status | assigned | Resolution | reopened | ||
| Fixed in Version | HEAD | ||||
| Summary | 0000661: Cisco MZIP format support | ||||
| Description | Some Cisco Catalyst devices running IOS software packed by ''mzip'' format. This format use ''MZIP'' as its header, and the first two byte ''MZ'' conflicts with DOS files. Here is a magic description I made for those file: <code> 0 string/b MZIP Cisco IOS mzip compressed data >0x4 belong x \b, version %d >0x8 belong x \b, entry point 0x%x !:ext bin !:mime application/octet-stream </code> The format name comes from TrID identification result. Some future tests should be performed on full testset to prevent other unexpected collisions. | ||||
| Steps To Reproduce | 1. Download a Cisco IOS firmware either from cisco.com, or from the [[https://archive.org/download/cIOS-firmware-images/cat3560/|Internet Archive]], like [[https://archive.org/download/cIOS-firmware-images/cat3560/c3560-ipservicesk9-mz.122-25.SED1.bin|this one]]. 2. Run `file` on the file: <code> ~> file -v file-5.46 magic file from /usr/share/file/misc/magic seccomp support included ~> file -k ./Downloads/c3560-ipservicesk9-mz.122-25.SED1.bin ./c3560-ipservicesk9-mz.122-25.SED1.bin: MS-DOS executable, MZ for MS-DOS\012- data ~> file --mime -k ./Downloads/c3560-ipservicesk9-mz.122-25.SED1.bin ./c3560-ipservicesk9-mz.122-25.SED1.bin: application/x-dosexec\012- application/octet-stream; charset=binary <code> The expected result is at least not MS-DOS executable. | ||||
| Additional Information | The format is not much documented officially. The only thing mentioned ''mzip'' is [[https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/01_understanding_ios.htm|here]]: > The following may be added if the image has been "zip" or "mzip" compressed: > x: mzip compressed However, there are only third-party sources on this format: 1. [[https://github.com/bvanheu/linux-cisco/blob/master/mziptools/mzip.h|bvanheu/linux-cisco]] implemented a tool which can parse the header. 2. TrID support this format based on info from [[https://file-extension.net/seeker/program_extension_cisco|File Extension Seeker]]. | ||||
| Tags | No tags attached. | ||||
|
|
Oh seems the editor here does not support doku wiki syntax... |
|
|
Added, thanks! |
|
|
I noticed commit abf6249 have added the type, thanks for quick response! However, seems the MIME type is not included, causing wrong result of mime type: > # file testcases/cisco_mzip_01 > testcases/cisco_mzip_01: Cisco IOS mzip compressed data, version 1, entry point 0x3000 > # file --mime testcases/cisco_mzip_01 > testcases/cisco_mzip_01: application/x-dosexec; charset=binary The IOS file is loaded by Cisco's bootloader, and not a DOS executable. Would it be possible to fix the mime type? |
|
|
I don't get that: [7:26am] 94>file -m ../magic/magic.mgc c3560-ipservicesk9-mz.122-25.SED1.bin c3560-ipservicesk9-mz.122-25.SED1.bin: Cisco IOS mzip compressed data, version 1, entry point 0x3000 [7:27am] 95>file --mime -m ../magic/magic.mgc c3560-ipservicesk9-mz.122-25.SED1.bin c3560-ipservicesk9-mz.122-25.SED1.bin: application/octet-stream; charset=binary This is with HEAD on GitHub. |
|
|
Oh I see the reason. I have an alias for the command: > alias file='file -m /etc/magic:/usr/share/misc/magic' Seems the MIME output depends on whether the new MIME is merged into one file or passed as a list, but the file type output kept the same. I have verified this at HEAD. Is this expected behavior or I should submit another bug ticket for this? |
|
|
Well, the order that the magic entries are processed is affecting the outcome. In this case, sorting is happening only for compiled magic entries and only inside individual magic components in the path of magic entries specified. I.e. if there is a match in a magic entry in /etc/magic, then processing will stop. |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2025-05-28 11:57 | silver | New Issue | |
| 2025-05-28 11:58 | silver | Note Added: 0004230 | |
| 2025-05-28 14:02 | christos | Assigned To | => christos |
| 2025-05-28 14:02 | christos | Status | new => assigned |
| 2025-05-28 14:02 | christos | Status | assigned => resolved |
| 2025-05-28 14:02 | christos | Resolution | open => fixed |
| 2025-05-28 14:02 | christos | Fixed in Version | => HEAD |
| 2025-05-28 14:02 | christos | Note Added: 0004231 | |
| 2025-05-29 12:02 | silver | Status | resolved => feedback |
| 2025-05-29 12:02 | silver | Resolution | fixed => reopened |
| 2025-05-29 12:02 | silver | Note Added: 0004248 | |
| 2025-05-29 14:06 | christos | Note Added: 0004249 | |
| 2025-05-30 09:14 | silver | Note Added: 0004252 | |
| 2025-05-30 09:14 | silver | Status | feedback => assigned |
| 2025-05-30 14:00 | christos | Note Added: 0004256 |
