First, traditional bundle  

¡¡¡¡This kind of principle is very simple, is also most one kinds which at present uses. Is attaches B.exe to A.exe end. Like this when A.exe is carried out, B.exe with was also carrying out. This kind of bundle's code is Man Wangdu is. I am most early know from jingtao one about in the class article. On present, already did not have any technique content.  

¡¡¡¡Examination method: Understands a PE knowledge slightly the human should know. A complete effective PE/EXE document, his inside has contained several absolute fixed characteristics [, no matter whether to add shell]. First, the document begins by MZ, with DOS following PE by PE \ 0 \ 0 openings. Had these two characteristics, the examination becomes very simple. Only need open object file search key words MZ or PE using a UltraEdit kind of tool. If found two or above two. Then explained that this document was certainly is tied up. However it is noteworthy that some generators have also used this principle, attaches the wooden horse to the generator end, user choice production time reads. Moreover on-line popular many patterns “the bundle document examination tool” is the document reads, then retrieval key words MZ or PE. Speaks of here, believed that everybody had a general understanding. That is so-called “the bundle document examination tool” is the completely uncertain same thing.  

¡¡¡¡Second, the resources wrap the bundle  

¡¡¡¡Is also very simple on this principle. The majority of detectors are cannot examine, but after the ash pigeon wooden horse auxiliary search may examine the bundle, after has not added shell processing the EXE document. But the average person can add the shell, therefore is also very unreliable. This has studied the programming or understood PE structure the human should know. The resources are in a EXE special sector. May use for any all things which contains EXE to need/not to need to use. Carried on 100% using this principle to exempt kills the bundle already to let the human make the animation. Everybody may download has a look. How is that bundle using this point? This only needs to use BeginUpdateResource, UpdateResource and EndUpdateResource these three API function may do decides. These three API function uses for to make the resources to renew/the replace to use. The author only need write a package bundle document in a head document Header.exe. document only to need section of release resources the first code. But the bundle uses time a document will release first, then three API functions which said with above will wait the bundle the file updating to this document in namely to complete the bundle. The similar principle is widely utilized on the wooden horse generator.  

¡¡¡¡Examination method: Generally this kind very difficult to examine. If you do not fear troublesome, may carry on the first object file peels off the shell. Then uses “the ash pigeon wooden horse auxiliary search” or “ResTorator” a kind of tool reads the resources carries on the analysis. But this method is not after all general. Therefore recommends has the condition friend to use the virtual machine.