48141

How can I identify a WinRAR SFX using a binary signature of some sort?

I'm looking for an answer similar to the one in this question, but for WinRAR instead of 7zip. Essentially I want an authoritative signature that I can say at least "All WinRAR generated self-extracting executables created with the Default SFX file in version 420 will have bytes 0x15, 0xa1, 0x45, 0xcc, 0x21, 0x98 at location 0x00027400, and other NON SFX files are unlikely to have this signature". Even better, if the same signature can be found in all versions of the WinRAR SFX files, even if they are in different locations.

By nature of how SFX's work, they will be very similar, except for the archive portion of the file, but some strings make poor identifiers (e.x., "This program cannot be run in DOS mode" is in every SFX, but it happens to also be in most other Windows executables)

Currently my method of determining a signature is to look at various versions of the WinRAR SFX, and finding sequences of 4 or 6 bytes that all files have in common. Unfortunately, there are a lot of these, making it difficult to pick one.

Answer1:

From TechNote.txt in the WinRAR installation folder:

<ol> <li>To process an SFX archive you need to skip the SFX module searching for the marker block in the archive. There is no marker block sequence (0x52 0x61 0x72 0x21 0x1a 0x07 0x00) in the SFX module itself.</li> </ol>

This you already indicated yourself: the unrar source code has in archive.cpp the code how it reads in a file. The maximum size of the SFX part will never be larger than the number defined in rardefs.hpp:

#define MAXSFXSIZE 0x100000

Answer2:

If I have it right, you'd like to look a file up and see if it is a valid SFX file built with WinRAR, right?

In this case, these are the PE signatures you should be looking for (haven't tried them, but they're listed in the PE sig DB linked at the bottom):

WinRAR-SFX=80E9A1C1C11368E4167546C1C1055EEB019D6864863746EB028CE05FF7D0 WinRAR-SFX=EB0102EB02CD20B880

Just get the entry point and see if these bytes are following in the right order. An extensive list of PE signatures is available at http://tot-ltd.org/packer.db.

Recommend

  • I've been taught not to place most methods in a general “System” class but where do they go ins
  • Casting pointers to larger structs to pointers to smaller structs
  • Is it possible to use Microsoft 2013 sharepoint search server as my search engine for my site
  • Multithreaded Server receives data from just one client JAVA
  • Random characters in CSS class names
  • Passing matrices from function to function in MATLAB
  • Dump all Raima db_VISTA Version 3.20 data to text
  • LDA: Why sampling for inference of a new document?
  • c#.NET USB device persistent identifier
  • Using recursion to search all combinations of elements in an array of integers
  • ANTLR4: Unrecognized constant value in a lexer command
  • How do I chomp a string if I have Perl 4?
  • What do getresuid() and setresuid() do?
  • Loopback validation on Properties who's types are other Models
  • MySQL: Difference between `… ADD INDEX(a); … ADD INDEX(b);` and `… ADD INDEX(a,b);`?
  • Retaining data after updating application
  • How to pass solution folder as parameter in command line arguments (for debug)?
  • several dataProvider per one Test in TestNG
  • How to handle elastic beanstalk deployment so it uploads only changed files
  • Getting media player state in windows phone 7
  • How to specify input and output paths from cmd.exe for a PowerShell script?
  • Filter strings with regex before casting to numeric
  • Memory error in python- how to use more memory
  • Differences in dis-assembled C code of GCC and Borland?
  • What does 'Language neutral' mean with regard to MAKELANGID?
  • Saving Changes After In-App Purchase Has Been Purchased
  • How to define custom class, title, and target in Link Browser for content elements and the new rte_c
  • Declaring variable dynamically in VB.net
  • How do I get HTML corresponding to current DOM tree?
  • Algorithm for a smudge tool?
  • javaw.exe and eclipse startup problems
  • Finding past revisions of files in StarTeam w/ .NET SDK / C#
  • Perl system calls when running as another user using sudo
  • How to show dropdown in excel using jrxml (jasper api)?
  • When should I choose bucket sort over other sorting algorithms?
  • SVN: Merging two branches together
  • Hibernate gives error error as “Access to DialectResolutionInfo cannot be null when 'hibernate.
  • How to CLICK on IE download dialog box i.e.(Open, Save, Save As…)
  • Can Visual Studio XAML designer handle font family names with spaces as a resource?
  • Checking variable from a different class in C#