Method redirectFunctionToVmTramp

src/pe.cpp:253–260

}

void PE::redirectFunctionToVmTramp(Function function, DWORD vmTrampRva)
{
	std::vector<BYTE> relToVmTrapBytes = convertToByteVector<DWORD>(vmTrampRva - (function.getStartRva() + 5));

	// replace first bytes of instruction with a redirection to the vm trampoline jump
	bytes[rvaToFileOffset(function.getStartRva())] = 0xE9;
	std::copy(relToVmTrapBytes.begin(), relToVmTrapBytes.end(), bytes.begin() + rvaToFileOffset(function.getStartRva() + 1));
}

void PE::removeOriginalFunctionBytes(Function function)
{