I see that binary translation is usually trace-based. Is it because one can not get the boundaries of functions? Is there function label in binary code?
There's no trivial answer to this. You could search for ret
instructions, but they are no guarantee that they are function boundaries as you could return from the middle of a function.
Searching for stuff like
mov ebp, esp
will work to some extent, but again, it's no guarantee.
Some compilers (most notably the Intel Compiler), will move branched blocks to after the function ends, and jump back into the function...