Search code examples
c++windowsfileheaderportable-executable

Check if a file contains another file

I'm talking about Windows PE files. Is there a way to check if one file contains another? I mean... What if I merge two programs like this

MZ header 1st program
PE header 1st program
.
.
. all the sections from 1st program
.
MZ header 2nd program
PE header 2nd program
.
.
. all the sections from 2nd program
.

into one runable program? Of course, only the first one would run.

Solution

  • In your case, you'd first want to get the offset and size information about the last section of the PE file(IMAGE_SECTION_HEADER). Once you have this information, you can read the chunk after (offset + size), and if it matches with another PE format (MZ magic number), then it would suggest that there is a second file appended to the first.