Method virtualizeFunction

src/pe.cpp:57–84

}

bool PE::virtualizeFunction(Function function)
{
	// todo: check if function can be vm'd (i.e. is sizeof(function->bytes) >= 5)

	if (!vmSection.isInitialised())
		vmSection.initialise(getNewSectionVirtualAddress(), getNewSectionFileOffset());

	if (!function.disassemble())
		return 0;

	if (!function.compileInstructionsToVirtualInstructions())
		return 0;

	removeOriginalFunctionBytes(function);

	DWORD bytecodeRva = vmSection.getWritePointerRva();

	// resolve branch instructions now we know bytecode rva
	function.resolveBranchInstructions(bytecodeRva);

	vmSection.addBytes(function.getVirtualInstructionBytes());

	// redirect function to a vm trampoline
	redirectFunctionToVmTramp(function, vmSection.getWritePointerRva());
	vmSection.addVmTramp(bytecodeRva);

	return 1;
}

bool PE::virtualizeFunctions()
{