LZEXE
From Just Solve the File Format Problem
(Difference between revisions)
(→Identification) |
|||
| (13 intermediate revisions by one user not shown) | |||
| Line 1: | Line 1: | ||
{{FormatInfo | {{FormatInfo | ||
|formattype=electronic | |formattype=electronic | ||
| − | |subcat= | + | |subcat=Compression |
| + | |subcat2=Executable compression | ||
|released=1989 | |released=1989 | ||
}} | }} | ||
| − | '''LZEXE''' is an executable compression utility, developed by Fabrice Bellard. It | + | '''LZEXE''' is an executable compression utility, developed by Fabrice Bellard. It compresses DOS [[MS-DOS EXE|.EXE]] files. |
| + | |||
| + | == Identification == | ||
| + | LZEXE-compressed files normally have ASCII "{{magic|LZ09}}" (v0.90) or "{{magic|LZ91}}" (v0.91 or 0.91e) at offset 28. | ||
| + | |||
| + | However, it was not uncommon for LZEXE users to modify this signature, for various reasons. Examples include [[ARJ#Self-extracting archives|ARJ self-extracting archives]], which have signature "{{magic|RJSX}}", and some [[RAR#Self-extracting archives|RAR self-extracting archives]], with signature "{{magic|RSFX}}". | ||
| + | |||
| + | More-robust identification is possible, in particular by looking at bytes near the ''start-of-execution'' point (refer to [[MS-DOS EXE#Special file positions]]). This is at a different location in every file. | ||
| + | |||
| + | Apparently, the 300+ bytes starting at the ''start-of-execution'' point are always the same for a given version of LZEXE -- and there are only three known versions. A possible signature is the byte sequence {{magic|06 0e 1f 8b 0e 0c 00 8b f1 4e 89 f7 8c db 03 1e 0a 00 8e c3}}, starting either at the ''start-of-execution'' point, or (for v0.91e) one byte beyond it. | ||
| + | |||
| + | Also, the author's signature appears in this area. Version 0.90 has "<code>*Fabrice BELLARD*</code>" at ''start-of-execution''+269. Versions 0.91 and 0.91e have "<code>*FAB*</code>" at ''start-of-execution''+233. | ||
| + | |||
| + | Hacked or otherwise patched variants of LZEXE seem to be relatively rare -- or maybe they're just hard to identify as such. Known examples: | ||
| + | * [[LHARK#Self-extracting archives]] | ||
| + | * [[PCX2EXE (Arminio Grgic)]] | ||
== Software == | == Software == | ||
| − | + | Compression: | |
| − | * | + | * {{CdTextfiles|californiacollect/his042/lzexe.zip|LZEXE v0.90}} (1989-10-30) - French |
| − | + | ** {{CdTextfiles|rbbsv3n1/magn/lzexe_e.zip|lzexe_e.zip}} - v0.90 with documentation translated to English by Luigi M. Bianchi | |
| − | ** v0. | + | * [https://bellard.org/lzexe/lzexe91.zip LZEXE v0.91] (1990-01-02) - French |
| + | ** {{CdTextfiles|pcmedic/utils/compress/lzexe91.zip|lzexe91.zip}} - v0.91 with English-language supporting material by Luigi M. Bianchi and Earle Robinson | ||
| + | * [https://bellard.org/lzexe/lzexe91e.zip LZEXE v0.91e] (1990-10-15) (also {{CdTextfiles|megademo2/UTILITY/FILE/LZEXE91E.ZIP|here}}) - English | ||
| + | * [{{SACFTPURL|pack|lzexe100.zip}} "LZEXE v1.00a"] by IS2 France Diffusion. Seems to be functionally identical to LZEXE 0.91. | ||
| + | * {{CdTextfiles|pcmedic/utils/compress/lzexeeng.zip|lzexeeng.zip}} - English translation of v0.91, unknown origin | ||
| + | |||
| + | Decompression, general: | ||
| + | * UNLZEXE - A widely-distributed open source utility, originally by Mitugu Kurizono (Kou). Versions "0.6" and above include patches by other authors, and might be unofficial. | ||
| + | ** {{CdTextfiles|swinnund/disk3/FILEUTIL/UNLZEX02.ZIP|v0.2}} (1990-03-29) | ||
| + | ** {{CdTextfiles|hof91/dos/unlze04.lzh|v0.4}} (1990-05-12) | ||
| + | ** {{CdTextfiles|20mnn/ARCHIVE/UNLZEXE5.ZIP|v0.5}} (1990-05-17) | ||
| + | ** {{CdTextfiles|simtel/simtel9211/msdos/filutl/unlzexe7.zip|v0.7}} | ||
| + | ** {{CdTextfiles|simtel/simtel9703/disk2/DISC2/EXECOMP/UNLZEXE8.ZIP|v0.8}} | ||
| + | ** https://github.com/mywave82/unlzexe - Modernized source code | ||
| + | * [https://github.com/virginwidow/mz-explode mz-explode] | ||
| + | * {{Deark}} (with <code>-m lzexe</code> option) | ||
| + | * [https://github.com/samrussell/rizzle Rizzle] | ||
| + | |||
| + | Decompression, for DOS: | ||
| + | * See [[Executable compression#Decompression software]] for some multi-format utilities that support LZEXE. | ||
| + | * UnLZEXE ([https://web.archive.org/web/20070101000000*/http://www.tbcnet.com/~clive/unlzexe.zip archived]) by Tenth Planet Software / Clive Turvey (for DOS) | ||
| + | |||
| + | Protectors (utilities that modify a compressed file to make it more difficult to identify and/or decompress): | ||
| + | |||
| + | * [{{SACFTPURL|pack|antilz.zip}} ANTI-UNLZEXE] | ||
| + | * [{{SACFTPURL|pack|lzalt03.zip}} LZALT v0.03] by Codon Software | ||
| + | * [{{SACFTPURL|pack|lzealt.zip}} LZEALT v1.04] by De Trans Software | ||
== Links == | == Links == | ||
* [https://bellard.org/lzexe.html LZEXE home page] | * [https://bellard.org/lzexe.html LZEXE home page] | ||
| − | + | * [https://www.lodsb.com/reversing-lz91-from-commander-keen Reversing LZ91 from Commander Keen] | |
| − | [ | + | * [https://cosmodoc.org/topics/lzexe/ Cosmodoc: LZEXE] |
Latest revision as of 12:37, 8 September 2023
LZEXE is an executable compression utility, developed by Fabrice Bellard. It compresses DOS .EXE files.
[edit] Identification
LZEXE-compressed files normally have ASCII "LZ09" (v0.90) or "LZ91" (v0.91 or 0.91e) at offset 28.
However, it was not uncommon for LZEXE users to modify this signature, for various reasons. Examples include ARJ self-extracting archives, which have signature "RJSX", and some RAR self-extracting archives, with signature "RSFX".
More-robust identification is possible, in particular by looking at bytes near the start-of-execution point (refer to MS-DOS EXE#Special file positions). This is at a different location in every file.
Apparently, the 300+ bytes starting at the start-of-execution point are always the same for a given version of LZEXE -- and there are only three known versions. A possible signature is the byte sequence 06 0e 1f 8b 0e 0c 00 8b f1 4e 89 f7 8c db 03 1e 0a 00 8e c3, starting either at the start-of-execution point, or (for v0.91e) one byte beyond it.
Also, the author's signature appears in this area. Version 0.90 has "*Fabrice BELLARD*" at start-of-execution+269. Versions 0.91 and 0.91e have "*FAB*" at start-of-execution+233.
Hacked or otherwise patched variants of LZEXE seem to be relatively rare -- or maybe they're just hard to identify as such. Known examples:
[edit] Software
Compression:
- LZEXE v0.90 (1989-10-30) - French
- lzexe_e.zip - v0.90 with documentation translated to English by Luigi M. Bianchi
- LZEXE v0.91 (1990-01-02) - French
- lzexe91.zip - v0.91 with English-language supporting material by Luigi M. Bianchi and Earle Robinson
- LZEXE v0.91e (1990-10-15) (also here) - English
- "LZEXE v1.00a" by IS2 France Diffusion. Seems to be functionally identical to LZEXE 0.91.
- lzexeeng.zip - English translation of v0.91, unknown origin
Decompression, general:
- UNLZEXE - A widely-distributed open source utility, originally by Mitugu Kurizono (Kou). Versions "0.6" and above include patches by other authors, and might be unofficial.
- mz-explode
- Deark (with
-m lzexeoption) - Rizzle
Decompression, for DOS:
- See Executable compression#Decompression software for some multi-format utilities that support LZEXE.
- UnLZEXE (archived) by Tenth Planet Software / Clive Turvey (for DOS)
Protectors (utilities that modify a compressed file to make it more difficult to identify and/or decompress):
- ANTI-UNLZEXE
- LZALT v0.03 by Codon Software
- LZEALT v1.04 by De Trans Software
