cexecutabletrace

how to find function boundaries in binary code


I see that binary translation is usually trace-based. Is it because one can not get the boundaries of functions? Is there function label in binary code?


Solution

  • There's no trivial answer to this. You could search for ret instructions, but they are no guarantee that they are function boundaries as you could return from the middle of a function.

    Searching for stuff like

    mov   ebp, esp 
    

    will work to some extent, but again, it's no guarantee.

    Some compilers (most notably the Intel Compiler), will move branched blocks to after the function ends, and jump back into the function...