bool PatchBlock::containsDynamicCall() { const ParseAPI::Block::edgelist & out_edges = block_->targets(); ParseAPI::Block::edgelist::const_iterator eit = out_edges.begin(); for( ; eit != out_edges.end(); ++eit) { if ( ParseAPI::CALL == (*eit)->type() ) { // see if it's a static call to a bad address if ((*eit)->sinkEdge()) { using namespace InstructionAPI; Instruction::Ptr insn = getInsn(last()); if (insn->readsMemory()) { // memory indirect return true; } else { // check for register indirect set<InstructionAST::Ptr> regs; Expression::Ptr tExpr = insn->getControlFlowTarget(); if (tExpr) tExpr->getUses(regs); for (set<InstructionAST::Ptr>::iterator rit = regs.begin(); rit != regs.end(); rit++) { if (RegisterAST::makePC(obj()->co()->cs()->getArch()).getID() != boost::dynamic_pointer_cast<RegisterAST>(*rit)->getID()) { return true; } } } } } } return false; }