Let's say I have a .jar file and wrap it into a .exe using any number of free utilities out there, like JSmooth.
Would it be possible to tell, given just the .exe, if it was generated using one such utility from a .jar file?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
I did a quick test with JSmooth and it simply places the whole .jar file in a resource. You can easily see this by opening a JSmooth executable with Resource Hacker as the following screen shot shows (I used sun's deploy.jar from the java lib folder):
For other utilities it might be different but you could use a tool like binwalk to look for the jar/zip signature inside the exe.
The exe is probably just a small add-on that will execute the java interpreter on a set of packed classes. I don't know more details about how they go about their job, but there's big chance that the jar file sits unmodified inside the generated exe
You could take a look at the generated files with a hex viewer and there's a high chance you'll find a jar signature (to find out create a small jar file, look at it with a hex viewer, pack it and search for specific content from the original jar in the packed file)
You can simply grep the file for "
java.exe... This will usually be a pretty good indicator whether or not the program is a Java wrapper or not.
archenoth@Hathor ~/apps/Minecraft $ grep javaw.exe /host/Windows/notepad.exe archenoth@Hathor ~/apps/Minecraft $ grep javaw.exe ./Minecraft.exe Binary file ./Minecraft.exe matches archenoth@Hathor ~/apps/Minecraft $
This is because wrappers usually contain the following: