How do you identify function boundaries when reverse engineering?

Look for the prologue/epilogue patterns (frame setup and teardown) and call/ret pairs — these bracket each function in the disassembly.

Without symbols you must recognize functions by their characteristic entry and exit code.

x86-64 entry — either a full frame setup:

push %rbp
mov  %rsp, %rbp
sub  $0x20, %rsp

…or just a stack reservation (no-frame-pointer style):

sub  $0x28, %rsp

x86-64 exit — leave; ret, or add $N,%rsp; ret:

leave
ret

IA-32 entry is almost always the classic push %ebp; mov %esp,%ebp.

Other strong hints:

• Functions usually start at aligned addresses.
• Every call target is a function entry point.
• A symbol table, if present, labels entries directly.
• Disassemblers like Ghidra and IDA auto-detect functions from exactly these patterns.

Tip: when a tool's auto-analysis misses a function, manually finding a push %rbp; mov %rsp,%rbp after a ret is often how you spot the boundary by hand.

Go deeper:

• Function prologue and epilogue (Wikipedia) — the prologue/epilogue signatures that bracket functions.