Skip to main content

Table 1 Example of function recognition

From: Code fusion information-hiding algorithm based on PE file function migration

Filename File size (bytes) Function sequence number Function size (bytes) Function address range Relative virtual address range
notepad.exe 5632 1 126 D5D-DDA 195D-19DA
2 85 0FE8-103C 1BE8-1C3C
3 394 1173-12FC 1D73-1EFC
4 346 36F9-3852 42F9-445A
5 496 4D49-4F38 594C-5B3B
thunder.exe 1808176 1 203 1C36-1D00 1C36-1D00
2 152 1D01-1D98 1D01-1D98
3 1648 21D5-2844 21D5-2844
4 206 2FE4-30B1 2FE4-30B1
5 218 359F-3678 359F-3678