How can I identify functions and their size in a x86-64 executable binary (PE)

78 Views Asked by At

Using an x86 disassembler such as capstone, are there known algorithms that I can use to identify functions and their respective sizes in a portable executable?

I found Architecture Agnostic Function Detection in Binaries which is exactly what I am trying to achieve, but this software is closed source and the explanation is not technically detailed enough for me to implement an actual algorithm.

The article mentions the use of a linear sweep, but it doesn't specify a sweep for what?

Furthermore, are functions always contiguously stored, meaning that they do not intertwine? Otherwise what I am trying to achieve may not be possible in the first place.

I tried scanning for function's epilogues and prologues without success.

0

There are 0 best solutions below