Skip to main content
  1. RAR5 Parsing in Pure Python
    • Validates the RAR5 magic header
    • Iterates through RAR5 headers (HEAD_TYPE, HEAD_FLAGS)
    • Extracts header body, extra area, and data area
  2. ADS Detection
    • Scans for :<streamname> markers that indicate Alternate Data Streams
    • Handles streams embedded in XTRA blocks and across header/data areas
  3. Safe Extraction
    • Dumps the raw ADS bytes to an output directory
    • Filenames follow the pattern: <basefilename>__<streamname>
  4. Automatic Decoding (when possible)
    • If the ADS is stored (uncompressed) as plain text, attempts decoding:
      • UTF-8 / UTF-16 / UTF-32 / Latin-1
      • Creates an additional *.decoded.txt file with readable content
    • If the ADS is RAR-compressed or encrypted, preserves the raw bytes for further analysis