SoftwareZIPPhil Katzfile formatsPKWARE
A ZIP file is read from the back, and every file inside it begins with Phil Katz's initials
PKWARE's own spec puts the directory at the end, which is why you can append to an archive, bolt it onto an .exe, and lose all of it by cutting the tail.
Open a ZIP and the reader doesn’t start at byte zero. It goes to the end of the file and hunts for a record with the signature 0x06054b50. The spec calls it the “end of central directory record,” says a ZIP “MUST contain” one and “MUST have only one,” and the layout puts it last, after the central directory headers. That record points back to the central directory, which lists every file and points to each one.
Wikipedia’s account says tools “must scan for the end of central directory record signature” and “must not scan for entries from the top of the ZIP file.” The record “is located at the end of the archive structure in order to allow the easy appending of new files.” That one decision explains most of what ZIP can do. Add a file and only the tail gets rewritten. Prepend a program and the archive still works, which is how a self-extracting archive “will begin with an executable file header,” as Wikipedia puts it, with the ZIP riding behind.
The front of the file holds data too. Each entry opens with a local header, signature 0x04034b50, and the spec says each file “MUST be preceded by” one. The “PK” is the 0x4b50 half of every signature. Wikipedia reads it as “the initials of the inventor Phil Katz.”
There is a wrinkle for streaming. If a program is writing a ZIP to a pipe, it can’t go back and fill in a file’s size and checksum once it knows them. Bit 3 of the flags handles that: the spec says the header’s “crc-32, compressed size and uncompressed size are set to zero” and “the correct values are put in the data descriptor immediately following the compressed data.” It says the descriptor “SHOULD be used only when it was not possible to seek in the output .ZIP file.”
The format exists because of a lawsuit. Wikipedia’s Phil Katz article says System Enhancement Associates, maker of ARC, sued Katz and PKWARE over PKARC; an independent expert found PKARC “a derivative work of ARC,” and the case settled in August 1988 with PKWARE dropping the ARC name. PKWARE moved to PKZIP and published the format, and the spec credits Katz’s friend Robert Mahoney with the name “zip.”
One thing the spec does not say is how to find the end record: it describes where the record sits, not a scanning procedure. The advice to scan backwards comes from Wikipedia, not PKWARE.
My money says the format outlasts everything built on it. It is 38 years old, it is documented in a text file, and its odd back-to-front layout is still the reason it is so easy to bolt things onto.
PK, in hex, in everything.