News for hackers. Stuff that matters.
Re:.apks are just .zips; semi-legally hacking software for o... by JimDabell on Saturday March 28, 2026 @02:55AM (#47552253)
The same is true for iPhone apps (.ipa files). You can just unzip them.
Re:.apks are just .zips; semi-legally hacking software for o... by zekica on Saturday March 28, 2026 @03:54AM (#47552502)
.docx and .xlsx are also just zip files with XML and attachments. The bad thing is that the XML is Word's internal document structure serialized and behavior for some values is only defined in Microsoft's code.
Re:.apks are just .zips; semi-legally hacking software for o... by godman_8 on Saturday March 28, 2026 @03:58AM (#47552517)
Even pk3 files from the id Tech engine are just zip files.
Re:.apks are just .zips; semi-legally hacking software for o... by karamanolev on Saturday March 28, 2026 @05:48AM (#47553106)
I've worked on docx and xlsx import/export and the public documentation for the formats was sufficient for normal documents (maybe excluding some very exotic features). That was ca 2010.
Re:.apks are just .zips; semi-legally hacking software for o... by HelloUsername on Saturday March 28, 2026 @03:16AM (#47552340)
For many things. Change .epub to .zip for example, you get html text and jpg images
Re:.apks are just .zips; semi-legally hacking software for o... by saagarjha on Saturday March 28, 2026 @05:20AM (#47552964)
They are typically encrypted, though.
Re:.apks are just .zips; semi-legally hacking software for o... by zffr on Saturday March 28, 2026 @10:28PM (#47559922)
Well the executable binaries inside IPAs are encrypted, but the IPA bundles themselves are typically unencrypted. You should be able to see unencrypted assets inside of them
Re:.apks are just .zips; semi-legally hacking software for o... by kotaKat on Saturday March 28, 2026 @05:42AM (#47553077)
Sometimes you also find hidden things lurking accidentally left behind in IPAs and APKs that are nice and juicy and realize they've been shipped on Google Play/App Store for years.

I've found everything from entire copies of internal company manuals to working test credentials for a physical place with a membership barcode in debug logs left inside the app from developers.

Also sometimes changelogs left inside by accident which include things like "It hasn't been sanitized for outside consumption and thus should remain internal to <company>. Deliver it externally at your own risk of embarassment."

Re:.apks are just .zips; semi-legally hacking software for o... by echelon_musk on Saturday March 28, 2026 @06:57AM (#47553440)
Wait till people discover file(1)!
Re:.apks are just .zips; semi-legally hacking software for o... by kotaKat on Saturday March 28, 2026 @07:38AM (#47553651)
Even better, wait until people discover 7zip's 'parser mode' on Windows (especially). Right click a file -> 7zip -> Open archive -> #:e mode. Really fun way to quickly carve out files and snoop around. I use it like a poor man's binwalk to extract firmware files and updates and etc out of things to usual success.

(#:e Parser mode, ignoring full archives, and checks every single byte position of a file for 'start of archive' bytes to parse archives out of a larger file.)

Re:.apks are just .zips; semi-legally hacking software for o... by mjmas on Saturday March 28, 2026 @08:57AM (#47554169)
That's helpful. I always wondered what the * and # modes were for and why some sometimes only one of them worked.
Re:.apks are just .zips; semi-legally hacking software for o... by ruguo on Saturday March 28, 2026 @07:32AM (#47553616)
Indeed so
Re:.apks are just .zips; semi-legally hacking software for o... by thenthenthen on Saturday March 28, 2026 @07:53AM (#47553748)
It is zip files all the way down
Re:.apks are just .zips; semi-legally hacking software for o... by bombcar on Saturday March 28, 2026 @10:33AM (#47554978)
The elites don’t want you to know this but the distribution file formats on the web are zips you can just unzip them I have 458 zips.