4

I'm examining my Windows programs to determine which ones are written in Java, and if so, whether they import a log4j library affected by the log4shell vulnerability.

Programs that are packaged as JAR files and use the JVM to run are fairly easy to identify.

However, I am less certain about .exe files. Usually these are compiled from say C++, but there are ways to compile Java code into .exe files.

Is there a method to identify whether an .exe was written using Java? Is this method reliable?

3
  • Hi and welcome to RE.SE. It's just a guess, but if there is such a thing, I'd look in the resource section of the PE file first and then in the overlay (which could come before or after a potential signature).
    – 0xC0000022L
    Dec 17, 2021 at 9:43
  • If you run the program and thus have access to the log file you can simply insert a sample exploit canary token and if the url appears in the log but the canary is not triggered you know that the program is safe.
    – Robert
    Dec 17, 2021 at 21:56
  • Thanks all for the responses - doesn't seem like there's an easy way! I'll check out the PE file for a few exes..
    – Trent Gm
    Dec 21, 2021 at 19:51

1 Answer 1

2

Been a while since I went back to any Java reversing, but I seem to remember being able to use 7zip to open “Java executables” with a .exe file extension.

Most (if not all?) .jars have a META-INF folder within them, so this is usually a pretty easily identifiable folder to look for.

This could probably be automated fairly easily. You could write a script that tries to “extract” .exes and if the base level directory contains META-INF then there is a good chance it's a packaged .jar.

Edit for clarity: as 'masterX244' pointed out, I was referring to the .exe files that are essentially a Jar file with a small stub loader of an executable tacked on to the front of it (which handles all the JVM args, etc, internally). The reference I have has the initial stub, and the Jar itself starts at offset 0x12A00 (location found via the PK magic number). I had not considered graalVM as suggested by 'Thorbjørn Ravn Andersen', so this only works under specific circumstances.

4
  • 1
    Hi and welcome to RE.SE. The question wasn't about JAR files, though. In fact the question mentions how JAR files are easy to spot and investigate, but the concern lies with .exe files which "package" Java applications, so to speak.
    – 0xC0000022L
    Dec 17, 2021 at 9:45
  • 2
    There is one variant of Java Exes that is just a JAR with a exe loader for loading the JVM tacked in front.
    – masterX244
    May 18, 2022 at 7:22
  • 1
    This is most likely only for those wrappers that add a binary launcher to the existing zip files (which the standard allows). The full compilers like GraalVM behave differently. May 14, 2023 at 16:59
  • I updated my answer to clarify slightly and to add some additional info. As pointed out by Thorbjørn this does not work in cases where cross-compiling/similar has been used. Never the less, knowing about the java .exe executables (and how to remove the .exe stub) is handy to know as a reverse engineer.
    – Kaden
    Mar 9 at 4:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.