The MAR file format is used within MSN Explorer, in version 8 and probably others, and the MSN Installer. MSN here means Microsoft as an ISP, and you need a subscription to MSN Premium to install MSN Explorer. MSN Explorer is just Internet Explorer with extra bells and whistles.

In the scant unofficial documentation I could find online, .mar files are referred to as “Microsoft Archive” files, and you could also call them MSN Archive since they are exclusively used by MSN, but through my reverse engineering attempts I have found a CMarsArchiveFile::OpenArchiveFile string within a DLL used by most of the MSN components. Mars was the codename of MSN Explorer¹ and there are multiple references to Mars within its COM APIs.

I remember playing around with MSN Explorer 6 when I was younger, and getting a @msn.com e-mail address to show off to my friends who were all using @hotmail.fr on MSN Messenger, all for free. Now than MSN Dial-up is almost completely shut down however, it is becoming more of an adventure to get a working MSN Explorer installation. I am looking into reverse-engineering the MSN installer and its HTTPS requests so I can maybe find out how to unblock it, messing around with it since it uses a lot of JavaScript, and then hopefully getting MSN Explorer 8 or maybe 9 to work, while of course documenting as much as I can.

I found .mar files under C:\Program Files\MSN\MSNInstaller\, which came with my XP Pro SP3 installation, and they seem to include various BMP and XML files that define how the installer should be styled and what it should display. I want to extract those to better understand how the installer works.

.mar was interpreted by my system as being shortcuts to Microsoft Office Access reports, which they definitely are not.

I have written a Kaitai Struct schema for this file format.

File structure

The file uses little-endian and ASCII encoding everywhere.

Magic

Magic number: 4D 41 52 43, aka MARC in ASCII

Version

Unsigned 32-bit integer, probably a version number. My files all had the value 3.

File count

Unsigned 32-bit integer, number of file headers.

File headers

See File header below. Repeated File count times.

File contents

See File contents below.

File header

Name

Name of the file. 56-byte string, either ASCII or UTF8 encoded (probably only ASCII). If the string is shorter than 56 bytes, all the remaining bytes are null (0x00).

Size

Unsigned 32-bit integer. Size, in bytes, of the file. This can be zero if the file is empty.

CRC32

Unsigned 32-bit integer. Checksum of the file’s contents using the CRC32 algorithm.

Offset

Unsigned 32-bit integer. Absolute offset, in bytes, within the archive file of where this file’s contents start. All offsets should start after the end of all of the file headers. Multiple file headers may refer to the same offset.

File contents

The contents of all files are stored, uncompressed and concatenated, after all the file headers. There are no specific bytes or data structures separating them. To distinguish them, use the size and offset attributes of the file headers.