JAR hidden inside EXE?

Question

Minecraft, a Java game, is free this weekend. The Windows version downloads as an exe file. I was curious what the EXE file is doing and where it\'s unpacking and running th

Answer 1

The ZIP (and by extension, JAR) file format is flexible in that it allows the archive to be embedded inside another file format. This is what makes self-extracting ZIP archives possible (some small code is embedded in areas that the ZIP file parameters ensure are ignored by unzip utilities). It has also been used for some particularly sneaky exploits as well.

My guess is that Minecraft similarly exploited the ability to make the archive a valid Windows executable and added code to launch the JVM with itself in the classpath.

See also: Wikipedia: Combining ZIP with other file formats

Answer 2

If you want a quick solution without delving too much and using a wrapper, Jsmooth does its job well.

Answer 3

This used previously to be very common - especially in the days of floppy disks where space was precious and it was tedious for the unzip program to be on a different disk than the zip file.

The reason why it can be done is because the zip-file inventory structure is located at the end of the zip-file, not the front, so a zip file can contain a large number of initial irrelevant bytes as long as the inventory structure does not point to them (and by extension jar-files too). A very frequent use for this has been to enclose a small unzip-only program which could then unpack the zip file.

One utility to prepend such a program is the unzipsfx. Here is a manual page for it: http://linuxcommand.org/man_pages/unzipsfx1.html

It appears that Minecraft uses another prepended program which invokes Java on itself.

---

EDIT: Looked inside with an hex editor. Minecraft.exe is wrapped with Launch4j.

Answer 4

after renaming Minecraft.exe to Minecraft.jar, I was able to open it and see the loader class files and such

Some EXE files are in fact self-extracting ZIP files. JAR files are in turn normal ZIP files with a special file structure. I bet that you was just opening it using a ZIP tool after renaming it. Note that some ZIP tools will auto-integrate in Windows explorer (or the other way round) so that it happens seemingly transparently.

Answer 5

Launch4J does this. It's really pretty impressive.