Jump Resolving¶

After recovering a CFG from a binary, there may be calls that have an unknown target. Indirect jump resolving is the process of discovering some, or all, of the targets those jumps may go to. A basic implementation of this is Switch statements resolving, since they are often compiled into indirect jumps ¹.

The work in this area has mostly focused on ways to reduce the total set of analyzed pointers while doing pointer analysis²³. Additionally, these works have used program knowledge to further reduce constant-reducible pointers, like those found in class initialization in C++².

Indirect Jump Example¶

A simple indirect jump looks like the following in x86:

jmp [rax];

Since pointer analysis is considered hard, it may not be trivial to find the value of rax.