JAR hidden inside EXE?

Question

Minecraft, a Java game, is free this weekend. The Windows version downloads as an exe file. I was curious what the EXE file is doing and where it's unpacking and running the actual game JAR from. So using a command, I found the command-line arguments to the running javaw.exe process; and oddly enough, it was launched with a classpath pointing to the executable! (meaning, the .exe file was acting as a jar). Indeed, after renaming Minecraft.exe to Minecraft.jar, I was able to open it and see the loader class files and such, as if it were a normal JAR file and not an EXE at all.

How is this possible? And how can I do it with my own JAR files?

and double clicking the EXE file starts the game? That's some crazy stuff! — jrharshath, Sep 20 '10 at 19:04
Could this be related to how self-extracting archives work (WinZip)? After all Jar is basically a Zip archive, right? In fact, you can add a Zip file to the classpath as well, are you sure it wasn't one? — Mark Peters, Sep 20 '10 at 19:07
I don't think so. renaming a self-extracting archive will not magically give it a jar file structure... — jrharshath, Sep 20 '10 at 19:07
@Here Be Wolves: I'm pretty sure a self-extracting archive still conforms to the Zip file format standard, which is basically the same as the Jar file format. — Mark Peters, Sep 20 '10 at 19:10
In that case, this might be something of that kind of magic.. BTW, could you post any links to explain the file format of such a zip file? — jrharshath, Sep 20 '10 at 19:13

Thorbjørn Ravn Andersen · Accepted Answer · 2017-07-06T15:20:29.983

This used previously to be very common - especially in the days of floppy disks where space was precious and it was tedious for the unzip program to be on a different disk than the zip file.

The reason why it can be done is because the zip-file inventory structure is located at the end of the zip-file, not the front, so a zip file can contain a large number of initial irrelevant bytes as long as the inventory structure does not point to them (and by extension jar-files too). A very frequent use for this has been to enclose a small unzip-only program which could then unpack the zip file.

One utility to prepend such a program is the unzipsfx. Here is a manual page for it: http://linuxcommand.org/man_pages/unzipsfx1.html

It appears that Minecraft uses another prepended program which invokes Java on itself.

EDIT: Looked inside with an hex editor. Minecraft.exe is wrapped with Launch4j.

Thanks for figuring out that Launch4j is the wrapper! Very interesting. — Ricket, Sep 24 '10 at 15:00
I've now used launch4j as a replacement for JSMooth in a project for a while. No error reports so far. — Thorbjørn Ravn Andersen, Dec 13 '13 at 14:47

score 3 · Answer 2 · answered Sep 20 '10 at 19:08

3

after renaming Minecraft.exe to Minecraft.jar, I was able to open it and see the loader class files and such

Some EXE files are in fact self-extracting ZIP files. JAR files are in turn normal ZIP files with a special file structure. I bet that you was just opening it using a ZIP tool after renaming it. Note that some ZIP tools will auto-integrate in Windows explorer (or the other way round) so that it happens seemingly transparently.

answered Sep 20 '10 at 19:08

BalusC

1,082,665
372
3,610
3,555

On second thought, the answers aren't strictly the same, so I added an answer myself. I don't think the OP was looking at a self-extracting ZIP file; they just use the same mechanism to put executable code in the zip archive. – Mark Peters Sep 20 '10 at 19:23

score 2 · Answer 3 · answered Sep 20 '10 at 19:23

The ZIP (and by extension, JAR) file format is flexible in that it allows the archive to be embedded inside another file format. This is what makes self-extracting ZIP archives possible (some small code is embedded in areas that the ZIP file parameters ensure are ignored by unzip utilities). It has also been used for some particularly sneaky exploits as well.

My guess is that Minecraft similarly exploited the ability to make the archive a valid Windows executable and added code to launch the JVM with itself in the classpath.

See also: Wikipedia: Combining ZIP with other file formats

Haha, your name, at first glance, is so similar to Markus Persson (creator of Minecraft) that I thought for a moment this was an "official" answer of the question from him. — Ricket, Sep 24 '10 at 14:58

score 2 · Answer 4 · answered Sep 20 '10 at 19:57

2

Launch4J does this. It's really pretty impressive.

answered Sep 20 '10 at 19:57

Ricky Clarkson

2,909
1
19
21

open source but in addition "Launch4j may be used for wrapping closed source, commercial applications." – Nicolas Raoul Sep 21 '10 at 06:13
1

I peeked inside. Minecraft is wrapped with Launch4j. – Thorbjørn Ravn Andersen Sep 24 '10 at 09:25

score 1 · Answer 5 · answered Sep 20 '10 at 19:04

1

If you want a quick solution without delving too much and using a wrapper, Jsmooth does its job well.

answered Sep 20 '10 at 19:04

Ta01

31,040
13
70
99

will jsmooth create an exe that can be renamed as JAR, *and treated like a jar*? – jrharshath Sep 20 '10 at 19:06
The jsmooth wrappers does not create valid jar files. – Thorbjørn Ravn Andersen Sep 21 '10 at 02:01

JAR hidden inside EXE?

5 Answers5

Linked

Related