3

I'm a little bit confusing about how does zip and unzip software identity whether the file its opening is a zip file or not.

AFAIK, a program can identify a file with extension .zip is a zip file, and without extension there are some magic bits or MIME type that can be used to determine the file type.

The problem is: if I open a self-extracting executable .exe file like AMD's driver installer using 7-zip, it still can open the file and the contents are showing correctly. But the "executable" parts are gone. And how does 7-zip determine this file type? Shouldn't the .exe files have PE headers on Windows?

What's more confusing: I've found that an ISO file can be decompressed using 7-zip, but the 7-zip says it can handle that file type, so it's fine. But if I open the VirtualBox Installer using 7-zip, the file content is like:

.rsrc/
.data
.rdata
.reloc
.rsrc_1
.text
CERTIFICATE

These files are the resource file within the exe, and 7-zip reported the file type is PE, so I guess it is acting like resource hacker and shows the resource files? But not all exe files can be opened in this way, why? And when I opened the Open VPN Installer, the file content is like:

$PLUGINSDIR
$TEMP
bin
doc
easy-rsa
sample-config
icon.ico
Uninstall.exe.nsis

And this is basically what I will get after installation except those $ folders. And the file type is Nsis, the same as the self-extracting executable .exe. So I assume they are using the same mechanics, am I right? But why this file is not PE type? Or the 7-zip is just a Swiss Army knife kind software that can handle any file types? But how does 7-zip identify it?

I've been wondering this question for a long time, any help will be appreciated!

2

You have encountered two executable files that can be opened by 7-Zip but the mechanism behind is totally different:

7-Zip shows the internal structure of Executables

.rsrc/
.data
.rdata
.reloc
.rsrc_1
.text
CERTIFICATE

This list is a special function of 7zip. Executables can't be unzipped but they have an internal structure and 7Zip knows about this structure and presents you a view that looks like a ZIP archive but instead shows the internal structure of the executable file.

Executables that have an "attached" ZIP file

Your second example - the installer file is a combination of an executable + plus a ZIP file appended to the executable.

$PLUGINSDIR
$TEMP
bin
doc
easy-rsa
sample-config
icon.ico
Uninstall.exe.nsis

When the installer is executed only the executable front part is executed. Then this code part performs a self-extraction by searching it's own executable file for the beginning of the ZIP file. Then this ZIP file is extracted and processed by the installer.

When opening such a file 7zip and other archive extraction tools are searching for the ZIP file start and just ignore the executable front part. Therefore you can open such executable files and see the content without having to execute the installer.

Note that not all installer use this way or use a proprietary archive format that can't be viewed by 7-zip. Hence if you open such an installer you only get the view of the executable structure.

| improve this answer | |
2

You are really asking about how any program opens any file type. The short answer is: it reads the file header; and "YES" 7-zip is a program that recognizes lots of types of files.

The longer answer is that most files (virtually all) have a structured section called a header that identifies itself and the manner and location of all the parts being stored.

The file extension is often the first indicator, but many programs don't accept that as "safe data" but rather verify it by checking the header. So the extension is the best way to narrow down to an expected set of potential headers. As for the extension being "untrustworthy" I mean to say that it is human editable and does not affect the file contents. Easy example: a Word ".docx" file renamed to ".zip" unzips without complaint using Windows Explorer.

The first several bytes of a file often have a tag of some sort identifying them. Once the program checks this, it then decides what to do next and hopes the file is structured properly so that it can use it; if it does not conform to expectation, it complains (throws an error).

The first two bytes of a TIFF file start with "II" or "MM" (intel or motorola byte order), followed by 2 bytes for version information (always 42, very important); then 4 bytes telling the software where to jump to to get the file information "tags". Once it jumps to the tag, 12 bytes per tag; etc. A TIFF can be read and understood without recourse to a file extension, thought software such as Photoshop may balk because it wants the hint that the .TIF extension offers.

Some of the information in that TIFF is variable or non-standard and so the software uses the header to decide where to find the information it can use. Note that TIFF image data can be compressed with LZW compression which might be considered a descendant of the compression (originally?) used in zip.

A scitex image file (SCT) and jpeg image file (JFIF) have radically different headers than the TIFF header, but if one wants to write software to handle those three file types and sort the images by aspect ratio, one needs to run comparisons on the header information to recognize the file type and then run a separate procedure to read the width and height of each type.

All file storage schemes (including EXE and Self-Extractors) use the header concept, but the schema actually used varies.

And "YES" 7-zip is a program that has a lot of header definitions that it recognizes.

| improve this answer | |
  • For more complete detail, the fiie(1) command in Unix/Linux comes with a large database of fingerprints to identify file contents. – vonbrand Mar 6 at 14:41
1

A self-extracting archive consists of a short "stub" program that locates ZIP content that is within the same file and extracts it. Zip utilities commonly are also able to recognize when an EXE is a self-extracting archive, and to treat it as a zip-file.

| improve this answer | |
0

Your computer identify files using extensions, it recognizes that .zip file is an archive file format. Files with extension .exe are executable and used by Windows operating system. You can imagine them as executable archives, that contains files with code. Files also contains headers about it's type. The PE type stands for Portable Executable format. Archives managers are very universal tools, because lots of files are just archives and the extension only indicates how the file is used. You can for example try to open .pptx in your archive manager (7-zip).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.