1. Entry feature identification method

PEID\FFI and other shell checking tools all use this method

2. File entropy calculation, reference

/s?cl=3&wd=%CE%C4%BC%FE%EC%D8%D6%B5&fr=ikw1000

3. Section method:

Judgment Is the file entry point in the first section? If not, it means it has been packed.

It is recommended to go to [Kanxue Security Forum], there are many similar articles on it.