Refactor: Symmetric architecture — shared function discovery for CFF and Junk modes

[sondt99]

Summary

Both obfuscation modes now follow the same pipeline pattern, eliminating the asymmetric architecture where Junk mode loaded the PE 2-4 times redundantly.

Before

CFF:  pe64 → pdbparser → obfuscatecff → save  (1 PE load, explicit in main.cpp)
Junk: func2rva(pe64+pdbparser) → filter → LIEF(same file!) → inject → save  (2-4 PE loads, hidden)

After

Both: FunctionDiscovery(path) → [filter/select] → engine-specific work → save

CFF:  FunctionDiscovery → sym_func adapter → pe64 → obfuscatecff → save
Junk: FunctionDiscovery → filter_functions → LIEF → TrampolineInjector → save

New common/ Module (5 files)

File	Purpose
function_info.h	Shared FunctionInfo struct used by both modes
function_discovery.h/.cpp	Single PE+PDB load, returns function list
function_filter.h/.cpp	Blacklist filtering, size filtering, interactive selection

Key Changes

• Junk mode no longer loads PE redundantly — was 2-4 loads (RVAResolver×1-2 + temp TrampolineInjector + real TrampolineInjector), now 1 load (FunctionDiscovery) + 1 load (LIEF for actual injection)
• main.cpp orchestrates both modes symmetrically — validate → discover → engine → save
• JunkCodeManager accepts pre-discovered functions instead of creating internal RVAResolver
• DbgHelp singleton safe — FunctionDiscovery is scoped and destroyed before CFF creates its pe64

Checklist

• common/function_info.h — shared struct
• common/function_discovery.h/.cpp — single load, tested
• common/function_filter.h/.cpp — blacklist + size filter + interactive selection
• JunkCodeManager::run_auto_injection_mode uses ObfuGuard::filter_functions
• JunkCodeManager::run_manual_injection_mode uses ObfuGuard::select_functions_interactive
• main.cpp CFF mode uses FunctionDiscovery in scoped block
• main.cpp Junk mode uses FunctionDiscovery in scoped block
• vcxproj and vcxproj.filters updated with new files
• No RVAResolver created in new code paths
• LIEF Parser::parse called exactly once (inside TrampolineInjector)
• Old private methods preserved for backward compatibility

Test plan

• Build succeeds in Release|x64
• CFF mode: obfuscate test binary, verify output runs
• Junk auto mode: obfuscate test binary, verify output runs
• Junk manual mode: select functions interactively, verify output
• Run match_check.py on full 60-binary test suite
• Verify no redundant PE loads (grep confirms)