RAR 5.0 file format: headers

A RAR 5.0 archive is the signature followed by headers, each with an optional data area after it. This page follows RARLAB’s RAR 5.0 archive format note. The extra records that headers carry, and the service headers, are on extra records and services.

Data types

Type	Meaning
`vint`	Variable-length unsigned integer: the low 7 bits of each byte are data, least significant group first; the high bit is set when another byte follows. Up to 10 bytes for 64 bits. A writer may reserve space by starting with `80` bytes, which add nothing (`80 80 05` is 5).
`byte`, `uint16`, `uint32`, `uint64`	Fixed-size unsigned integers, little-endian.

Archive layout

Self-extracting module, optional. RAR searches for the signature in the first 1 MB (the limit at the time of the note; it may grow).
Signature, 8 bytes: 52 61 72 21 1A 07 01 00 (Rar!, 1A 07 01 00). The RAR 1.5 to 4.x signature is the 7 bytes 52 61 72 21 1A 07 00; see RAR4.
Archive encryption header, when the headers are encrypted.
Main archive header.
Archive comment service header, optional.
File headers, each followed by its data and by its own service headers.
Quick open service header, optional.
Recovery record, optional.
End of archive header.

General header

Every header starts with these fields.

Field	Type	Description
Header CRC32	uint32	CRC-32 of the header from the size field to the end of the extra area.
Header size	vint	Size of the header from the type field to the end of the extra area. At most 3 bytes, so a header is at most 2 MB.
Header type	vint	See header types.
Header flags	vint	See header flags.
Extra area size	vint	Only with flag `0001`: size of the extra area at the end of the header.
Data size	vint	Only with flag `0002`: size of the data area after the header. For a file, the packed size.
…		The fields of this header type.
Extra area	…	Extra records.
Data area	…	Not counted in the header size or CRC.

Header types

Type	Header
`1`	Main archive header
`2`	File header
`3`	Service header
`4`	Archive encryption header
`5`	End of archive header

Header flags

Flag	Meaning
`0001`	An extra area is present.
`0002`	A data area is present.
`0004`	When updating, skip this block if its type is unknown; otherwise an unknown block makes the archive impossible to update.
`0008`	The data area continues from the previous volume.
`0010`	The data area continues in the next volume.
`0020`	The block depends on the preceding file block.
`0040`	Keep this child block when its host block is modified.

Main archive header (type 1)

Field	Type	Description
Archive flags	vint	See below.
Volume number	vint	Only with flag `0002`: 1 for the second volume, 2 for the third and so on. The first volume has no field.
Extra area	…	Optional locator (type `01`) and metadata (type `02`) records.

Archive flag	Meaning
`0001`	A volume: part of a multi-volume set.
`0002`	The volume number field is present (every volume except the first).
`0004`	Solid archive.
`0008`	A recovery record is present.
`0010`	Locked archive: it must not be changed.

File header (type 2) and service header (type 3)

Both have the same fields. A service header holds data that belongs to the archive or to the file before it, such as a comment or an NTFS stream; its name says which (see service headers).

Field	Type	Description
File flags	vint	See below.
Unpacked size	vint	Size after extraction. Ignore it when flag `0008` is set.
Attributes	vint	Attributes of the host system: Windows file attributes, or the Unix mode. Zero for service headers.
mtime	uint32	Only with flag `0002`: modification time in Unix format.
Data CRC32	uint32	Only with flag `0004`: CRC-32 of the unpacked data. For a file split across volumes, every part but the last holds the CRC of that volume’s packed data.
Compression information	vint	See compression information.
Host OS	vint	`0` Windows, `1` Unix.
Name length	vint	Length of the name in bytes.
Name	…	UTF-8, no NUL at the end. See below.
Extra area	…	Optional file extra records.
Data area	…	The file’s data, compressed or stored.

File flag	Meaning
`0001`	A directory (file headers only).
`0002`	The mtime field is present.
`0004`	The data CRC32 field is present.
`0008`	The unpacked size is unknown: extract until the compressed stream ends.

Names use / between folders on every system. On Unix a \ is an ordinary character; on Windows it is not allowed. Unix names with high-ASCII bytes that cannot be converted to Unicode are stored with those bytes mapped to U+E080 to U+E0FF and the marker U+FFFE; such names are not portable.

Compression information

Bits (mask)	Meaning
0 to 5 (`003F`)	Algorithm version: `0` needs RAR 5.0 or later, `1` needs RAR 7.0 or later.
6 (`0040`)	Solid: this file continues the dictionary of the previous ones. File headers only.
7 to 9 (`0380`)	Method, 0 to 5: `0` no compression, then fastest to best.
10 to 14 (`7C00`)	Dictionary size `N`: 128 KB × 2^N. 0 is 128 KB, 1 is 256 KB, 15 is 4 GB, 19 is 64 GB, 23 is 1 TB (the most possible). Values over 15 need version 1.
15 to 19 (`F8000`)	Version 1 only: adds this value × dictionary size ÷ 32 to the dictionary size, giving 31 steps between powers of two.
20 (`100000`)	Version 1 only: the data uses the version 0 algorithm although the dictionary is described in the version 1 way. Used when version 1 files are added to a version 0 solid stream.

The note numbers these bits from 1; the masks are the same. The compression algorithm itself is not published; the UnRAR source code is the only public description.

Archive encryption header (type 4)

Present when the headers are encrypted, straight after the signature.

Field	Type	Description
Encryption version	vint	`0`: AES-256, the only one defined.
Encryption flags	vint	`0001`: password check data is present.
KDF count	byte	Binary logarithm of the PBKDF2 iteration count.
Salt	16 bytes	Salt for the key, shared by all encrypted headers.
Check value	12 bytes	Only with flag `0001`: 8 bytes made from extra PBKDF2 rounds, to reject a wrong password, then a 4-byte checksum of those 8 bytes.

After it, every header is a 16-byte AES initialisation vector followed by the encrypted header, padded to a multiple of 16 bytes.

End of archive header (type 5)

Field	Type	Description
End of archive flags	vint	`0001`: this archive is a volume and not the last of its set.

RAR reads nothing after this header, so other tools can append data there, such as a digital signature.

Example

The start of a RAR 5.0 archive, signature and main archive header:

52 61 72 21 1A 07 01 00   signature
33 92 B5 E5               header CRC32
0B                        header size 11 (type to end of extra area)
01                        type 1, main archive header
01                        header flags: extra area present
07                        extra area size 7
00                        archive flags: none
06 01 01 80 80 80 00      extra: locator record, size 6, type 1, flags 1, quick open offset reserved

This header is put together from the note to show the layout; the CRC bytes are a placeholder, not a computed value. The 80 80 80 00 is a vint of 0 written with reserved space, filled in once the quick open data has been written.

.RAR File Format – Headers