一种基于信息熵的PE文件加壳检测方法

病毒文件经常加壳且壳的种类繁多，壳的特征经常变化。导致现有的基于特征库的壳检测软件经常失效，不能判断出一个文件是否加壳。提出一种基于信息熵的文件加壳检测算法，可以在壳特征经常变化的情况下，对文件是否加壳做出有效的判断。

Another PE File Shell-Adding Detecting Method based on Information Entropy

Virus file usually have various shell outside and its feature vary often.Thus,shell detecting software which rely on Shell Feature will fail.They cann't judge if the file has shell on it.This article bring forward one method of file shell adding detecting based on Information enthopy.This method can still provide right judgement on file shell condition even though the shell's feature change often.