A RAR 1.5 to 4.x archive is a chain of blocks. This page follows the
technote.txt that RARLAB shipped with RAR 2.x and 3.x; the parts that note
leaves out (the end of archive block, newer subblocks, extended times and Unicode
names) are from the public UnRAR source, and are marked. Numbers are little-endian.
RARLAB no longer publishes this note: its site now has only the RAR 5.0 technote.
Checked 2026-11-12 against the RAR 3.93 technote.txt as redistributed in
php-rar
and the UnRAR 7.1.8 source (headers.hpp, arcread.cpp,
encname.cpp, unpack.cpp on
sources.debian.org).
Block header
| Offset | Size | Name | Description |
|---|---|---|---|
0 | 2 | HEAD_CRC | Low 16 bits of the CRC-32 of the header from HEAD_TYPE on (for some types, a set part of it). |
2 | 1 | HEAD_TYPE | See block types. |
3 | 2 | HEAD_FLAGS | Flags; the low byte depends on the type, see below for the two common bits. |
5 | 2 | HEAD_SIZE | Size of the header, including these 7 bytes. |
7 | 4 | ADD_SIZE | Only with flag 8000: size of the data after the header. The block is then HEAD_SIZE + ADD_SIZE bytes. In a file header this field is PACK_SIZE. |
| Flag | Meaning |
|---|---|
4000 | UnRAR’s SKIP_IF_UNKNOWN: older RAR versions that do not know the block delete it when updating the archive. If clear, they copy it unchanged. |
8000 | ADD_SIZE is present. |
Block types
| Type | Block |
|---|---|
72 | Marker block |
73 | Archive header |
74 | File header |
75 | Old-style comment header |
76 | Old-style authenticity information |
77 | Old-style subblock |
78 | Old-style recovery record |
79 | Old-style authenticity information |
7A | Subblock (RAR 3.x service block) |
7B | End of archive (not in the note; from UnRAR) |
Marker block
The signature is laid out as a block: HEAD_CRC 6152,
HEAD_TYPE 72, HEAD_FLAGS 1A21,
HEAD_SIZE 0007, which gives the seven bytes
52 61 72 21 1A 07 00 (Rar! …). Its CRC is not checked. A
self-extracting archive has a program in front of it; the note says the marker bytes
never occur in RAR’s own self-extracting modules, so a reader can search for them.
Very old RAR versions before 1.5 used a different signature, 52 45 7E 5E
(RE~^), and a different layout that this page does not cover.
Archive header (type 73)
| Offset | Size | Name | Description |
|---|---|---|---|
0 | 7 | Block header | HEAD_CRC covers HEAD_TYPE to RESERVED2. HEAD_SIZE includes any old-style comment inside it. |
7 | 2 | RESERVED1 | UnRAR calls it HighPosAV: with RESERVED2, the position of the authenticity block. |
9 | 4 | RESERVED2 | UnRAR calls it PosAV. |
| Flag | UnRAR name | Meaning |
|---|---|---|
0001 | MHD_VOLUME | Part of a multi-volume set. |
0002 | MHD_COMMENT | An old-style comment is inside this header. RAR 3.x uses a separate comment block and does not set it. |
0004 | MHD_LOCK | Locked: must not be changed. |
0008 | MHD_SOLID | Solid archive. |
0010 | MHD_NEWNUMBERING | Volumes are named name.partN.rar rather than .rar, .r00, .r01…. |
0020 | MHD_AV | Authenticity information is present (not set by RAR 3.x). |
0040 | MHD_PROTECT | A recovery record is present. |
0080 | MHD_PASSWORD | Block headers are encrypted. |
0100 | MHD_FIRSTVOLUME | The first volume (set only by RAR 3.0 and later). |
With encrypted headers, UnRAR reads an 8-byte salt before each block after the
archive header and decrypts the block header with the RAR 3.x method
(CRYPT_RAR30) keyed by the password and that salt.
File header (type 74)
| Offset | Size | Name | Description |
|---|---|---|---|
0 | 7 | Block header | HEAD_CRC covers the header from HEAD_TYPE to the end of the name and following fields. Flag 8000 is always set. |
7 | 4 | PACK_SIZE | Compressed size, low 32 bits. |
11 | 4 | UNP_SIZE | Uncompressed size, low 32 bits. |
15 | 1 | HOST_OS | See host OS. |
16 | 4 | FILE_CRC | CRC-32 of the uncompressed file. |
20 | 4 | FTIME | Modification time, MS-DOS date and time (time in the low 16 bits). |
24 | 1 | UNP_VER | Version needed to extract, 10 × major + minor: 15 RAR 1.5, 20 RAR 2.0, 26 RAR 2.0 with files over 2 GB, 29 RAR 2.9 and 3.x. |
25 | 1 | METHOD | See methods. |
26 | 2 | NAME_SIZE | Length of FILE_NAME. |
28 | 4 | ATTR | File attributes of the host system (DOS/Windows attributes, or the Unix mode). |
32 | 4 | HIGH_PACK_SIZE | Only with flag 0100: high 32 bits of the packed size. |
36 | 4 | HIGH_UNP_SIZE | Only with flag 0100: high 32 bits of the unpacked size. |
| … | NAME_SIZE | FILE_NAME | The name. See names. |
| … | 8 | SALT | Only with flag 0400: salt for the encryption key. |
| … | … | EXT_TIME | Only with flag 1000: see extended times. |
The note warns that new fields may be added after these; HEAD_SIZE
says where the header really ends. The compressed data follows.
File header flags
| Flag | UnRAR name | Meaning |
|---|---|---|
0001 | LHD_SPLIT_BEFORE | The file continues from the previous volume. |
0002 | LHD_SPLIT_AFTER | The file continues in the next volume. |
0004 | LHD_PASSWORD | Encrypted with a password. |
0008 | LHD_COMMENT | A file comment is present (RAR 3.x uses a separate block). |
0010 | LHD_SOLID | Solid: uses data from the previous files (RAR 2.0 and later). In a subblock (type 7A) the same bit means the subblock belongs to the file before it. |
00E0 | dictionary | Bits 7 to 5: 000 64 KB, 001 128 KB, 010 256 KB, 011 512 KB, 100 1024 KB, 101 2048 KB, 110 4096 KB, 111 the entry is a directory. |
0100 | LHD_LARGE | HIGH_PACK_SIZE and HIGH_UNP_SIZE are present (files over 2 GB). |
0200 | LHD_UNICODE | The name has a Unicode form; see names. |
0400 | LHD_SALT | The 8-byte salt is present. |
0800 | LHD_VERSION | An old version of the file: ;n with the version number is added to the name. |
1000 | LHD_EXTTIME | The extended time field is present. |
8000 | Always set: the block is HEAD_SIZE + the packed size. |
Host OS
| Value | System |
|---|---|
0 | MS-DOS |
1 | OS/2 |
2 | Win32 |
3 | Unix |
4 | Mac OS |
5 | BeOS |
Methods
| Value | Method |
|---|---|
30 | Storing |
31 | Fastest compression |
32 | Fast compression |
33 | Normal compression |
34 | Good compression |
35 | Best compression |
The method is a level; the algorithm is set by UNP_VER. The
algorithms (LZ and Huffman in RAR 1.5 and 2.0, with audio and multimedia filters in
2.0, and LZ plus PPMd with a virtual machine for filters in 2.9) are described publicly
only by the UnRAR source.
Names
Folders are separated by \ in archives made on DOS and Windows. Without
flag 0200, the name is in the system’s code page (OEM on DOS). With it,
FILE_NAME holds the ordinary name, a zero byte, then an encoded Unicode
name; if there is no zero byte, the whole name is UTF-8.
The encoded Unicode name (from UnRAR) starts with a byte giving a default high byte. Then a flags byte supplies four 2-bit codes, high bits first, and a new flags byte is read after every four:
| Code | Next character |
|---|---|
0 | One byte; high byte 0. |
1 | One byte; high byte is the default. |
2 | Two bytes, low then high. |
3 | A length byte L. If L has bit 7 set, a correction byte C follows and (L & 7F) + 2 characters are copied from the ordinary name at the same position, each with C added to the low byte and the default high byte; otherwise (L & 7F) + 2 characters are copied as they are. |
Extended times
From UnRAR. A 2-byte flags word gives four 4-bit groups, from the top: modification,
creation, last access and archiving time. In each group, bit 3 means the time is
present, bit 2 adds one second (DOS times have 2-second steps), and bits 1 and 0 give
how many extra bytes (0 to 3) of finer time follow, the most significant of a 24-bit
count of 100-nanosecond units. The modification time uses FTIME as its
base and has no 4-byte DOS time of its own; each other present time starts with a
4-byte DOS time, then its extra bytes.
Old-style blocks (types 75 to 79)
Written by RAR 2.x and earlier; RAR 3.x replaced them with type 7A
subblocks. The fields after the block header are from UnRAR.
| Type | Fields after the block header |
|---|---|
75 comment | UNP_SIZE 2, UNP_VER 1, METHOD 1, COMM_CRC 2, then the comment, compressed unless stored. Found inside the archive header (flag 0002) or after a file header (flag 0008). |
76, 79 authenticity | The electronic signature of a registered RAR user; its contents are not public. |
77 subblock | DATA_SIZE 4, SUB_TYPE 2, LEVEL 1, then the data. Sub types: 0100 OS/2 extended attributes; 0101 Unix owner; 0102 Mac OS file type and creator; 0103 BeOS extended attributes; 0104 NTFS access control list; 0105 NTFS stream. |
78 recovery record | DATA_SIZE 4 (in the ADD_SIZE position), version 1, recovery sectors 2, total blocks 4, a mark of 8 bytes, then the recovery data. Its algorithm is not public. |
Subblock (type 7A)
RAR 3.x’s service block has the same fields as a file header; the name says what it holds (from UnRAR):
| Name | Holds |
|---|---|
CMT | Archive or file comment |
AV | Authenticity information |
RR | Recovery record |
ACL | NTFS access control list |
STM | NTFS alternate data stream |
UOW | Unix owner and group |
EA2 | OS/2 extended attributes |
QO | Quick open data (defined in UnRAR; mainly a RAR 5.0 feature) |
End of archive (type 7B)
From UnRAR; the note does not describe it. RAR 3.x writes it at the end of every archive or volume; older archives just end.
| Flag | UnRAR name | Meaning |
|---|---|---|
0001 | EARC_NEXT_VOLUME | Not the last volume. |
0002 | EARC_DATACRC | A 4-byte CRC-32 of the volume’s packed data follows the block header. |
0004 | EARC_REVSPACE | Space is reserved for the 7-byte record that recovery (.rev) volumes add at the end. |
0008 | EARC_VOLNUMBER | A 2-byte volume number follows. |