Creating Self-Extracting Archives (SFX) in WinRAR: Complete Guide

Self-extracting archives, also known as SFX, combine a compressed package with an executable which is responsible for extracting its contents upon execution. This allows data and small installations to be distributed without requiring the recipient to have a compatible compressor installed on their computer.

En Windows, SFX files usually have an .exe extension and behave like any other program. If you're concerned about security, remember that WinRAR You can open and examine SFX just like normal files, so you can view or extract their contents without running them.

What is a self-extracting archive (SFX) and when is it best to use it?

An SFX is a compression file that integrates an extraction module, so that when opened it is automatically decompress files which includes. The user does not need additional applications to display their content on Windows.

They are useful when you are sharing a package with someone who may not have a decompressor installed; see programs to compress files, Or if you want package and distribute your own software. Without going any further, the WinRAR installer itself is built on top of its default graphical SFX module.

An additional advantage is that if you prefer not to execute a received SFX (for example, out of caution against possible threats), you can open it with WinRAR and extract it like any RAR or ZIP file, without launching the .exe.

As for their identification, you will almost always see the .exe extension, just like any other Windows executable. This makes them extremely easy to use with a double-click.

For repetitive deployments, demos, or small internal releases, SFX allows you to simplify everything into a single executable with options very basic configuration and installation script.

SFX modules available in WinRAR

WinRAR includes several SFX modules that determine how the self-extractor behaves. For RAR archives, the default module is Default.sfx, while for ZIP it is used Zip.sfxThese modules must be in the same folder as winrar.exe to be available.

When working on 64-bit systems, WinRAR x64 uses by default the 64-bit SFX modules in graphics mode, although you can force 32-bit (Default32.sfx or Zip32.sfx) from the SFX options if you need it for compatibility.

Please note that 32-bit SFX will work on x86 Windows, but does not support compression dictionaries larger than 1 GB64-bit SFX, on the other hand, only runs on Windows x64.

For console (non-MS-DOS) extraction, WinRAR provides the module WinCon.SFX with 32-bit and 64-bit variants (WinCon32.SFX and WinCon64.SFX). You can explicitly select the desired module from the SFX options or on the command line.

All SFX modules return, by default, the same return codes than WinRAR. If you integrate a subsequent installer, with the appropriate directive (SetupCode), it is also possible to reflect the return of the program you run after the extraction is complete.

How to create an SFX with WinRAR (graphical interface)

The most direct method is from WinRAR itself. Select the files or folders you want to pack and click on “Add” to open the box “File name and parameters”.

On the General tab, check the option “Create an SFX file”If you already have a RAR/ZIP file open, you can also convert it to SFX by clicking the “Self-Extracting” button.

To choose the module (Default.sfx, Zip.sfx, WinCon.SFX, etc.), go into the SFX options and select the module most appropriate from the Module section. There you can define advanced settings.

From “Advanced Options…”, the graphical SFX lets you set the default destination route, the title and text of the window, and even customize the icon and certain messages from the “Text and Icon” tab.

If you need to revert an SFX to a normal file, in the Tools menu you will find the command to remove the SFX module; WinRAR will create a new archive without the self-extracting stub, keeping the contents intact.

Create and convert SFX from the command line

WinRAR also allows you to do it by terminal. To create a new file as SFX just use the -sfx modifier with the addition command (a). A couple of practical examples:

WinRAR a -sfx -v360 -s Juegos
WinRAR a -sfxWinCon.SFX Regalo.rar

In the first one you generate a file with self-extracting solid volumes 360 KB; the second forces the use of the WinCon.SFX console module when creating Regalo.rar. Note that you can also specify the module after -sfx.

If you already have a RAR file created and want to transform it to SFX, use the order S. For example, to inject the console module into “myfile.rar”:

WinRAR S WinCon.SFX miarchivo.rar

In interactive interpreter mode, this operation is equivalent to choosing the option Self-extracting in the parameters dialog or by clicking “Self-Extracting” on an open file. See also the command s if you need to specify the module directly.

SFX Comment Options and Directives (Default.sfx)

The Default.sfx graphics module supports a number of directives in the file comment which allow for controlling the self-extraction behavior and easy subsequent installation.

• Delete=: deletes the specified file before starting to extract. Example:
  Delete=winrar95.exe
• License= { … }: displays a license text before starting. The block in braces can contain HTML format basic. Example:
  License=End user license agreement {
  All copyrights to RAR are exclusively owned by the author.
  This program is shareware…
  }
• Overwrite=: Defines the overwrite mode (0 prompt, 1 overwrite all, 2 don't overwrite). Example:
  Overwrite=1
• Path=: sets the default extraction folder. Example:
  Path=C:\
• Presetup=: runs a program before to extract. Example:
  Presetup=uninstall.exe /clean
• SavePath: Remembers the user's chosen route to offer it in future runs. Example:
  SavePath
• Setup=: launches an executable at the end the extraction. Example:
  Setup=setup.exe
• Shortcut=Destination,Source,Folder,Description,AccessName: Create a shortcut. Target supports D (Desk), S (Start Menu), P (Start/Programs) and T (Home/Home). Example:
  Shortcut=D, winrar.exe, WinRAR, “WinRAR executable file”, “WinRAR archiver”
• Silent: 1 hides startup and progress; 2 hides only the startup dialog. Example:
  Silent=2
• TempMode]: extract to temporary folder and delete when finished (if there is one) -Setup). With parameters, displays question and title. Example:
  TempMode=Do you wish to continue installation of Calculator 3.05?, Calculator setup
• Text=String or block Text { … }: Adds text to the progress log (HTML is allowed). Example:
  Text=Here is my new program
• Title=: Sets the title of the extraction window. Example:
  Title=Calculator, version 3.05

With these directives you can create SFX that unpack into temporary folder, run an app and clean up temporary files, ideal for betas and quick distributions without complex installation.

Console SFX Module: Parameters and Usage

The console module allows you to extract and verify from the command line in Windows (not MS-DOS). Its supported parameters are very simple and direct:

• -e: extracts the contents (default action)
• -t: checks the integrity of files
• -v: detailed list of contents
• -?: shows help

As with the graphical module, console SFX returns the same return codes as WinRAR. Remember the compatibility by architecture: : 32-bit SFX works on x86 systems, while 64-bit requires Windows x64.

Visual customization and resource editing

If the initial SFX frame seems limited to you, you can adapt certain module visual resources (e.g., window size or images) with an external resource editor. WinRAR does not offer any tools or documentation for this task.

For more common changes like icon and logo, the “Advanced SFX Options > Text and Icon” allows you to customize them without touching the module’s resources.

Benefits, compatibility and alternatives

The SFX RARs stand out for their usability: The recipient runs a single .exe and that's it. In addition, RAR compression offers very good compression ratios and can be password-protected and encrypted.

Regarding compatibility, direct execution of SFX is specific to Windows, but it is possible on other systems. extract the content with tools like unrar or 7-Zip, without having to run the .exe.

If you prefer other routes, there are alternatives: ZIP (widely used but with less customization), 7-Zip/7Z (great compression but requires compatible software), WinZip (paid, with additional features) or Gzip (usual in Unix, without its own encryption).

For sensitive scenarios, consider encryption and overwrite control, along with message and shortcut customization, you can check a great difference in the deployment experience.

SFX Extraction on Different Systems

On Windows, with WinRAR you just need to double click on the SFX or open it from within the program to extract its contents to a folder of your choice.

From the console on Windows, some SFX accept parameters like -d to indicate path destination after the file name. In Linux or macOS, open Terminal and use unrar x file.exe folder/destination to extract the content.

Online extractors can be convenient, but uploading executables and data to third parties involves risksIf you choose this route, use trusted services and delete the files when you're done.

Best practices when sharing SFX

Protect with a strong password (minimum 12 characters, mixing types) and, if applicable, activate the content encryption from SFX options for an extra layer of security.

Avoid sending highly sensitive information via SFX. If there is no alternative, reinforce the control of the distribution channel (private links, recipient verification) and consider file or volume encryption solutions.

Use trusted platforms (e.g., storage in the cloud known) or FTP / SFTP for large uploads, and check file size policies if you plan to distribute by email.

Before sharing, perform a local test: validate the SFX integrity, the extraction path and that the scripts (Presetup/Setup) run as you would expect on a test machine.

Security: Malicious SFX, Distribution, and Self-Protection

Like any executable, an SFX can be used for malicious purposes. Threat groups have used SFX to hide loads that are extracted and executed without raising suspicion, sometimes chaining password-protected SFX inside each other.

Campaigns have been seen that use SFX to unauthorized mining or remote control (e.g., families such as CoinMiner or Quasar RAT), and emblematic cases of botnets that automate mining and execution without interaction.

Common vectors: email attachments, downloads from compromised pages, malicious ads, update spoofing and social engineering techniques.

Mitigation measures: keep system and software updated, open suspicious SFX with a filing cabinet to inspect its contentsAvoid clicking on dubious links and download only from trusted sites. A reputable, up-to-date antivirus helps detect and disinfect.