Detection failure of embedded RAR files created with RAR 5.0 archive format

[jxb5151]

Hello,

It seems that I cannot successfully detect embedded RAR files created using the RAR 5.0 archiver version. After a brief review of rar.py, I believe this is because of the slight difference in file format being used with the newer archiver.

Newer versions of WinRAR use a slightly different file magic for RAR files.

; RAR archive version 1.50 onwards
52 61 72 21 1A 07 00
; RAR archive version 5.0 onwards
52 61 72 21 1A 07 01 00

Quick testing...

; Successfully detected embedded RAR inside SFX file. Created with RAR archiver < 5.0
0002fff0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00030000  52 61 72 21 1a 07 00 cf  90 73 00 00 0d 00 00 00  |Rar!.....s......|
00030010  00 00 00 00 08 b9 7a 00  80 23 00 a8 00 00 00 38  |......z..#.....8|

; Unsuccessfully detected embedded RAR inside SFX file. Created with RAR archiver >= 5.0
00072bf0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00072c00  52 61 72 21 1a 07 01 00  2c 10 d9 3c 0b 01 05 07  |Rar!....,..<....|
00072c10  00 06 01 01 e4 ce 81 00  6a c4 39 9b 13 03 02 83  |........j.9.....|

To test independently, create a self extracting RAR file with an archiver version >= 5.0. The latest version of WinRAR (software version 5.50) uses this by default now.

   1. WinRAR and command line RAR use RAR 5.0 archive format by default.
      You can change it to RAR 4.x compatible format with "RAR4" option
      in archiving dialog or -ma4 command line switch.

[masatake]

NOTE: https://www.rarlab.com/technote.htm