可以从 PE 头部获取信息计算出 EXE 未被附加外部数据前的真实长度。
如果你得到的文件长度比这个值大很多。。那么肯定是自解压文件了。
/*
This code demostrates how to get the size of the
real executable. No matter whether you've added
extra data to the exe, the value should be the
original size.
*/
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
int main(void)
{
FILE *fp;
IMAGE_DOS_HEADER stDos;
IMAGE_NT_HEADERS stNT;
IMAGE_SECTION_HEADER stSection;
int nSize;
int i;
char szFile[MAX_PATH];
GetModuleFileNameA(0, szFile, MAX_PATH);
fp = fopen(szFile, "rb");
if(!fp)
{
printf("Can't open file for reading.\n");
return 1;
}
fread(&stDos, 1, sizeof(stDos), fp);
fseek(fp, stDos.e_lfanew, SEEK_SET);
fread(&stNT, 1, sizeof(stNT), fp);
nSize = stNT.OptionalHeader.SizeOfHeaders;
for(i = 0; i < stNT.FileHeader.NumberOfSections; i++)
{
fread(&stSection, 1, sizeof(stSection), fp);
nSize += stSection.SizeOfRawData;
}
fclose(fp);
printf("My size is %d bytes.\n", nSize);
return 0;
}