im quite new in this theme and im looking for a way how to extract .jar file from exe file ( upd. its graalvm native image ). If i open this exe as archive (7zip) i can see only .rdata and others ( https://i.postimg.cc/FRXJc92D/image.png , in .rsrc only icons), tried to check with ida pro but i cant extract jar. I think there must be a jar file cuz it opens with java and in hex i saw MANIFEST, COM.CLIENT.LAUNCHER (java path). So can anyone help me with it? If requires i can upload file
11
-
process monitor and etc also cant show anything– SulfurCommented Aug 7 at 4:25
-
This might help: reverseengineering.stackexchange.com/questions/34/…– RemkoCommented Aug 7 at 14:34
-
@Remko thanks for your comment but resource hacker, extract jar from hex code dont work– SulfurCommented Aug 7 at 15:55
-
i mean i cant find something useful there, for example: 1. Resource hacker shows only icon of the .exe 2. Extract jar from hex code: I tried to find PK and copy to .jar file but it shows corrupted jarfile. If i try automatic python scripts it does or empty jar file or corrupted jarfile– SulfurCommented Aug 7 at 16:28
-
zip directory is referenced by the entry at the end of the archive. anything that doesn't try to be "intelligent" should work....treat it as a zip, not an .exe, and don't give into convenience (for free).– Ali Rizvi-SantiagoCommented Aug 8 at 19:45
|
Show 6 more comments
2 Answers
Every .jar file has a signature 'PK'. This is how it looks in a hex-editor:
You can open your .exe file in a hex-editor and then find text 'PK' using Ctrl+F. It is usually aligned by 16 or 8 bytes.
After that, remove the contents of your .exe file that come before the 'PK' signature and you'll get your .jar file.
Your problem is that 7zip can read the structure of exe/dll files up to a certain point. But the zip/jar file is usually not contained in the exe structure itself instead it is just appended. Use a different zip client that can not interpret exe/dll files and thus opens the attached zip/jar file.
-
-
Maybe i can open .exe file and attach with x96db and extract jar? Can it help what do you think? I just attached and trying to find out something– SulfurCommented Aug 7 at 16:24
-
@Sulfur If WinRAR can't open it then the exe does not contain a JAR/ZIP file - at least not in plain text may the ZIP file is obfuscated or encrypted. If it opens something with Java check the command-line of the Java process and check the specified classpath entries. May the exe file extract the JAR file to a temp dir on start-up.– RobertCommented Aug 10 at 11:58