Tags: known-plaintext zip 

Rating:

## TL;DR
1. Find those known plaintext.
2. Count the mean and variance of output bit length at each position.
3. Reconstruct the splay tree from the end.
4. Recover central directory file header.
5. Reconstruct local file header based on central directory file header.
6. Reconstruct the initial splay tree.
7. Decrypt the zip and enjoy the flag.

Original writeup (https://sasdf.cf/ctf/writeup/2019/plaid/crypto/cypress/).