4

I'm examining my Windows programs to determine which ones are written in Java, and if so, whether they import a log4j library affected by the log4shell vulnerability.

Programs that are packaged as JAR files and use the JVM to run are fairly easy to identify.

However, I am less certain about .exe files. Usually these are compiled from say C++, but there are ways to compile Java code into .exe files.

Is there a method to identify whether an .exe was written using Java? Is this method reliable?

Improve this question
3
  • Hi and welcome to RE.SE. It's just a guess, but if there is such a thing, I'd look in the resource section of the PE file first and then in the overlay (which could come before or after a potential signature).
    – 0xC0000022L ♦
    Dec 17, 2021 at 9:43
  • If you run the program and thus have access to the log file you can simply insert a sample exploit canary token and if the url appears in the log but the canary is not triggered you know that the program is safe.
    – Robert
    Dec 17, 2021 at 21:56
  • Thanks all for the responses - doesn't seem like there's an easy way! I'll check out the PE file for a few exes..
    – Trent
    Dec 21, 2021 at 19:51

1 Answer 1

Reset to default
2

Been a while since I went back to any Java reversing, but I seem to remember being able to use 7zip to open “Java executables”.

Most (if not all?) .jars have a META-INF folder within them, so this is usually a pretty easily identifiable folder to look for.

This could probably be automated fairly easily. You could write a script that tries to “extract” .exes and if the base level directory contains META-INF then there is a good chance it's a packaged .jar.

Improve this answer
3
  • 1
    Hi and welcome to RE.SE. The question wasn't about JAR files, though. In fact the question mentions how JAR files are easy to spot and investigate, but the concern lies with .exe files which "package" Java applications, so to speak.
    – 0xC0000022L ♦
    Dec 17, 2021 at 9:45
  • 2
    There is one variant of Java Exes that is just a JAR with a exe loader for loading the JVM tacked in front.
    – masterX244
    May 18, 2022 at 7:22
  • This is most likely only for those wrappers that add a binary launcher to the existing zip files (which the standard allows). The full compilers like GraalVM behave differently.
    – Thorbjørn Ravn Andersen
    May 14 at 16:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.