Method for identifying at least one function of a kernel of an operating system of a virtual machine, said virtual machine comprising an operating system communicating with a hypervisor of a host system, said hypervisor interfacing between the operating system and hardware resources of the host system, said method comprising the following steps: - identifying (E10) an initial instruction (I 0 ) contained in the code of the kernel of the operating system of the virtual machine, - locating (E12-E18), by scanning the memory space, at least one following block of instructions belonging to at least one function of the kernel of the operating system of the virtual machine, said following block being situated in a memory area which follows the initial instruction, - locating (E22-E28), by scanning the memory space and by using a self-repairing disassembly mechanism, at least one preceding block of instructions belonging to at least one function of the kernel of the operating system of the virtual machine, said preceding block being situated in a memory area which precedes the initial instruction, - identifying (P3) a first block and a last block of instructions of the function of the kernel of the operating system from among the at least one following block and at least one preceding block, said identification consisting in searching (E27), in a reference database comprising the set of signatures of the blocks of instructions of the functions of the kernel of the operating system, a block signature in the set being associated with the name of a function of the kernel of the operating system, for the name of the function associated with the signatures of the first and last blocks of instructions, and recording a function start address and a function end address in association with the function of the kernel of the operating system, the function start address being the address of the first instruction of the first block and the function end address being the address of the last instruction of the last block. - identifying (E10) an initial instruction (I 0 ) contained in the code of the kernel of the operating system of the virtual machine, - locating (E12-E18), by scanning the memory space, at least one following block of instructions belonging to at least one function of the kernel of the operating system of the virtual machine, said following block being situated in a memory area which follows the initial instruction, - locating (E22-E28), by scanning the memory space and by using a self-repairing disassembly mechanism, at least one preceding block of instructions belonging to at least one function of the kernel of the operating system of the virtual machine, said preceding block being situated in a memory area which precedes the initial instruction, - identifying (P3) a first block and a last block of instructions of the function of the kernel of the operating system from among the at least one following block and at least one preceding block, said identification consisting in searching (E27), in a reference database comprising the set of signatures of the blocks of instructions of the functions of the kernel of the operating system, a block signature in the set being associated with the name of a function of the kernel of the operating system, for the name of the function associated with the signatures of the first and last blocks of instructions, and recording a function start address and a function end address in association with the function of the kernel of the operating system, the function start address being the address of the first instruction of the first block and the function end address being the address of the last instruction of the last block. <EOS>