From Forensics Wiki:
Field Name | Size (bytes) | Description |
---|---|---|
HEAD_CRC | 2 | CRC of fields from HEAD_TYPE to FILEATTR and file name |
HEAD_TYPE | 1 | Header Type: 0x74 |
HEAD_FLAGS | 2 | Bit Flags (Please see ‘Bit Flags for File in Archive’ table for all possibilities) |
HEAD_SIZE | 2 | File header full size including file name and comments |
PACK_SIZE | 4 | Compressed file size |
UNP_SIZE | 4 | Uncompressed file size |
HOST_OS | 1 | Operating system used for archiving (See the ‘Operating System Indicators’ table for the flags used) |
FILE_CRC | 4 | File CRC |
FTIME | 4 | Date and time in standard MS DOS format |
UNP_VER | 1 | RAR version needed to extract file (Version number is encoded as 10 * Major version + minor version.) |
METHOD | 1 | Packing method (Please see ‘Packing Method’ table for all possibilities |
NAME_SIZE | 2 | File name size |
ATTR | 4 | File attributes |
HIGH_PACK_SIZE | 4 | High 4 bytes of 64-bit value of compressed file size. Optional value, presents only if bit 0x100 in HEAD_FLAGS is set. |
HIGH_UNP_SIZE | 4 | High 4 bytes of 64-bit value of uncompressed file size. Optional value, presents only if bit 0x100 in HEAD_FLAGS is set. |
FILE_NAME | NAME_SIZE bytes | File name – string of NAME_SIZE bytes size |
SALT | 8 | present if (HEAD_FLAGS & 0x400) != 0 |
EXT_TIME | variable size | present if (HEAD_FLAGS & 0x1000) != 0 |
But the actual implementation of HEAD_CRC is the lower bits of CRC32 of header defined as in HEAD_SIZE without HEAD_CRC part calculated with standard polynomial of 0xEDB88320. I write it up here because RAR spec documents are crap. I hope this saves a couple of hours for someone.