Let's say I have a .jar file and wrap it into a .exe using any number of free utilities out there, like JSmooth.
Would it be possible to tell, given just the .exe, if it was generated using one such utility from a .jar file?
-
5Your title says one thing and the question body another. Could you please clarify which one is the real question?– Igor Skochinsky ♦Mar 20, 2013 at 2:17
Add a comment
|
4 Answers
I did a quick test with JSmooth and it simply places the whole .jar file in a resource. You can easily see this by opening a JSmooth executable with Resource Hacker as the following screen shot shows (I used sun's deploy.jar from the java lib folder):
For other utilities it might be different but you could use a tool like binwalk to look for the jar/zip signature inside the exe.
-
1Good answer, though of course other tools might not use the same approach. The question was a bit vague anyway though, so I think answering that specific implementation is the right way to go.– JordanMar 22, 2013 at 13:37
If the executable itself isn't packed or obfuscated you can often find the jar or class files by simply opening it in decompression utilty such as 7-zip.
-
You can decompress a jar file using something like 7-zip, but the question was clarified to extracting a jar from an exe, not an exe from a jar. Mar 27, 2013 at 1:00
-
4I understood the question. You can open the exe in 7-zip to find jar/class files. Mar 27, 2013 at 7:37
The exe is probably just a small add-on that will execute the java interpreter on a set of packed classes. I don't know more details about how they go about their job, but there's big chance that the jar file sits unmodified inside the generated exe
You could take a look at the generated files with a hex viewer and there's a high chance you'll find a jar signature (to find out create a small jar file, look at it with a hex viewer, pack it and search for specific content from the original jar in the packed file)
You can simply grep the file for "javaw.exe" or java.exe... This will usually be a pretty good indicator whether or not the program is a Java wrapper or not.
archenoth@Hathor ~/apps/Minecraft $ grep javaw.exe /host/Windows/notepad.exe
archenoth@Hathor ~/apps/Minecraft $ grep javaw.exe ./Minecraft.exe
Binary file ./Minecraft.exe matches
archenoth@Hathor ~/apps/Minecraft $
This is because wrappers usually contain the following:
