title: How can I identify a WinRAR SFX using a binary signature of some sort?
body: <p>I'm looking for an answer similar to <a href="https://stackoverflow.com/questions/9542538/recognize-a-7z-sfx-from-binary-contents">the one in this question</a>, but for WinRAR instead of 7zip.  Essentially I want an authoritative signature that I can say at least "All WinRAR generated self-extracting executables created with the Default SFX file in version 420 will have bytes 0x15, 0xa1, 0x45, 0xcc, 0x21, 0x98 at location 0x00027400, and other NON SFX files are unlikely to have this signature".  Even better, if the same signature can be found in all versions of the WinRAR SFX files, even if they are in different locations.</p>
  
  <p>By nature of how SFX's work, they will be very similar, except for the archive portion of the file, but some strings make poor identifiers (e.x., "This program cannot be run in DOS mode" is in every SFX, but it happens to also be in most other Windows executables)</p>
  
  <p>Currently my method of determining a signature is to look at various versions of the WinRAR SFX, and finding sequences of 4 or 6 bytes that all files have in common.  Unfortunately, there are a lot of these, making it difficult to pick one.</p>