Well, without reject Igor Skochinsky's answer I want to post this more landed in the fact of how to find where compressed data is.
Peter Kankowski wrote:
NSIS authors found a fast solution using marker. It's so simple that you will say: "Why didn't I think about it?!"
Just remember that data in an exe file is aligned by 512 or 4096 bytes. So you don't need to scan the whole exe for a marker, you just need to read 512-byte chunks and look for marker at their start. In pseudocode:
BYTE buff[512];
while(not end of file) {
ReadFile( 512 bytes into buff)
if(*(long*)buff == marker) {
// Marker found!
}
// else read another 512-byte chunk in the loop
}
I believe it's the simplest method; it's also faster than other methods with marker.
So as you can see NSIS installer have some sort of marker. So, just look for the ReadFile
API call, follow the program flow until the loops start again an watch for the last jump before the loop repeat it has to have a comparision around.
And there you have the marker.
If you want read more you can visit this very useful article: Self-extracting executables, thanks to Peter for a good adn clean explanation.