JWScan

JWScan is a reverse engineering tool that tells you if your PE file was packed by a Jar-To-EXE wrapper tool.

Scans PE files for embedded Jar, Zip, or Java bytecode files, displays the location, and can dump the files. Scans for Jar-to-EXE wrapper signatures of Launch4j, Exe4j, JSmooth, Jar2Exe. Scans for program independend indicators of Jar-to-EXE wrapper usage.

Usage

General usage:

java -jar jwscan.jar [-d <hexoffset>] <PEfile>

Example to get a report:

java -jar jwscan.jar myfile.exe

Example to dump at offset 0x5c00:

java -jar jwscan.jar -d 0x5c00 myfile.exe

Example output

JWScan 0.2.1 -- by Katja Hahn

scanning file ...

file name: ../../portextestfiles/launch4jexe.exe

Signatures found:
  * Jar manifest (strong indication for embedded jar)
  * Launch4j signature
  * PZIP Magic Number (weak indication for embedded zip)
  * Call to java.exe (strong indication for java wrapper)
  * Call to javaw.exe (strong indication for java wrapper)

ZIP/Jar offsets: 0x5c00

Build

Build this program via sbt

sbt assembly