Let's say I have a .jar file and wrap it into a .exe using any number of free utilities out there, like JSmooth.
Would it be possible to tell, given just the .exe, if it was generated using one such utility from a .jar file?
I did a quick test with JSmooth and it simply places the whole .jar file in a resource. You can easily see this by opening a JSmooth executable with Resource Hacker as the following screen shot shows (I used sun's deploy.jar from the java lib folder):
For other utilities it might be different but you could use a tool like binwalk to look for the jar/zip signature inside the exe.
If the executable itself isn't packed or obfuscated you can often find the jar or class files by simply opening it in decompression utilty such as 7-zip.
The exe is probably just a small add-on that will execute the java interpreter on a set of packed classes. I don't know more details about how they go about their job, but there's big chance that the jar file sits unmodified inside the generated exe
You could take a look at the generated files with a hex viewer and there's a high chance you'll find a jar signature (to find out create a small jar file, look at it with a hex viewer, pack it and search for specific content from the original jar in the packed file)
You can simply grep the file for "
java.exe... This will usually be a pretty good indicator whether or not the program is a Java wrapper or not.
archenoth@Hathor ~/apps/Minecraft $ grep javaw.exe /host/Windows/notepad.exe archenoth@Hathor ~/apps/Minecraft $ grep javaw.exe ./Minecraft.exe Binary file ./Minecraft.exe matches archenoth@Hathor ~/apps/Minecraft $
This is because wrappers usually contain the following: