Possible values for a computed destination address of an execution transfer instruction are found by a backward search through a flowgraph of a program. During the search, a symbolic expression for the destination address is successively modified to reflect the effect of each prior instruction until...http://www.google.com.hk/patents/US5428786?utm_source=gb-gplus-share專利 US5428786 - Branch resolution via backward symbolic execution
