RAR

Revision as of 18:50, 23 July 2022

RAR (Roshal Archive) is a compressed archive format used by the compression software RAR and WinRAR. It was originally for DOS, but has been widely used on Windows (as WinRAR) and other platforms.

The developers make the decompression code available for use in other programs and allow its distribution, but with a license provision that "You cannot use the unrar source to re-create the RAR compression algorithm, which is proprietary."

Discussion

Format classification

RAR can be considered to be a family of three main file formats:

• The (obsolete) format used by RAR before v1.50
• The format associated with RAR v1.50 through v4.x
• "RAR 5.0" format

Even within one of these classes, there can be significant differences between different RAR versions.

Early history

Some of the earliest versions of RAR appear to be lost. RAR v1.34 beta (1993-12-05) seems to be the oldest version known to still exist as of this writing. There were probably about a dozen earlier versions, starting with v0.1 in 1993-03^[1], but it's not clear which of them were released publicly. Of those that can be found, the first non-beta release seems to be v1.51 (1994-06-17).

Overview of DOS releases

RAR v2.50 (1999-03-24) was the last one for traditional 16-bit DOS. After that came versions 2.60 through 3.93, which use a 32-bit DOS extender. These versions are sometimes called "RAR32", though their actual name is still "RAR".

Self-extracting archives

RAR supports creating self-extacting archives. This is sometimes done simply by appending a RAR file to a pre-made "executable stub". Multiple stubs, or even customized stubs, may be available, so it's difficult to classify all of the RAR self-extracting archive formats. Distributions of RAR often include one or more stubs in files with an .SFX extension, though note that there may be additional stubs that are built into the software.

For the 16-bit DOS stubs, the decompressor is EXE-based, and is pre-compressed with LZEXE. The ASCII signature "RSFX" (instead of LZEXE's usual "LZ91") appears at offset 28.

While "RSFX" is indicative of a RAR self-extracting archive, it is not unique to the LZEXE-based formats, and it does not appear in all EXE-based RAR self-extracting archives.

Installation SFX

For at least RAR v1.54 through 2.50, an "installation SFX module" is available, in the included IDOS.SFX file. This stub features a script interpreter that processes a script stored in what would normally be the archive comment field. For an example RAR installation script, see the STANDARD.S file included with these versions.

File identification

RAR files made by versions prior to v1.50 start with bytes 52 45 7e 5e.

RAR files associated with versions 1.50 through 4.20 start with 7 signature bytes: 52 61 72 21 1a 07 00.

"RAR 5.0" format starts with 8 signature bytes: 52 61 72 21 1a 07 01 00.

Specifications

Before v1.50:

• RAR140DC.EXE (self-extracting RAR archive) → technote.doc

v1.50-4.20:

• wrar420.exe (self-extracting RAR archive) → TechNote.txt

5.0 format:

• RAR 5.0 archive format

Various:

• Forensics Wiki article

Software

• WinRAR website
  • Free UnRAR.dll
  • UnRAR source
• Konvertor
• 7-Zip
• The Unarchiver
• RAR: Various versions, at old-dos.ru
• WinRAR: Various versions, at old-dos.ru
• SAC archive, PACK section - Has lots of RAR software, but no easy way to get a list of it.
• RAR 1.40.2 beta (DOS)
• RAR 1.55 (DOS)
• RAR 2.50 (DOS)
• RAR 3.93 (DOS, OS/2)

Sample files

• http://cd.textfiles.com/ataricompendium/FILES/MISC/PRTFOLIO/
• http://cd.textfiles.com/thebbsorg/max_files/
• https://telparia.com/fileFormatSamples/archive/rar/ → *.rar

Links

• Wikipedia article
• Mini RAR poster
• ReScene's list of RAR versions

References

1. ↑ Discussion at [1]