Techniques for Refining Indirect Call Targets in Binaries

Identifying indirect call targets in binary code is a critical challenge in program analysis and security research. The Control Flow Graph (CFG), a fundamental tool in program analysis, faces significant complexity when constructing complete and precise representations due to the difficulty of statically determining the target addresses of indirect call nodes. The dynamic and flexible nature of indirect calls not only complicates analysis but also poses challenges for vulnerability detection and program optimization. This paper summarizes the key characteristics of indirect calls and systematically reviews existing methods for analyzing them. Furthermore, tools for identifying indirect call targets are categorized into three types based on their approaches: parameter-based tools, function pointerbased tools, and machine learning-based tools. By examining the principles, features, and applicable scenarios of each type, this paper highlights their strengths and limitations, offering valuable insights and guidance for future research.