Notices by Ange (ange@mastodon.social)

Some tools detect the EICAR file in Zip files by size and CRC so that it even detects it in password-protected zips without having the password.
This can of course lead to accidental or intentional FPs.

CRC-forging is also useful to collide arbitrary contents inside a ZIP archive. It makes possible re-usable and instant MD5 collisions for ZIP-based documents such as DOCX, XLSX, EPUB, XPS, 3MF.
https://speakerdeck.com/ange/inside-out-abusing-archive-file-formats

Some even detect a CRC-colliding file if there's no password.

An extreme example of a weird file construct, applicable to most formats:
a polymock, with fake file formats signatures at their correct offset.

My file formats dissection repo should be now up-to-date.
https://github.com/corkami/pics/blob/master/binary/README.md#images