Table 1 Example of function recognition
From: Code fusion information-hiding algorithm based on PE file function migration
Filename | File size (bytes) | Function sequence number | Function size (bytes) | Function address range | Relative virtual address range |
|---|---|---|---|---|---|
notepad.exe | 5632 | 1 | 126 | D5D-DDA | 195D-19DA |
2 | 85 | 0FE8-103C | 1BE8-1C3C | ||
3 | 394 | 1173-12FC | 1D73-1EFC | ||
4 | 346 | 36F9-3852 | 42F9-445A | ||
5 | 496 | 4D49-4F38 | 594C-5B3B | ||
… | … | … | … | ||
thunder.exe | 1808176 | 1 | 203 | 1C36-1D00 | 1C36-1D00 |
2 | 152 | 1D01-1D98 | 1D01-1D98 | ||
3 | 1648 | 21D5-2844 | 21D5-2844 | ||
4 | 206 | 2FE4-30B1 | 2FE4-30B1 | ||
5 | 218 | 359F-3678 | 359F-3678 | ||
… | … | … | … |