On the Origins of Indirect Jumps in Embedded Software

Indirect control-flow transfers complicate control-flow graph (CFG) construction, thereby reducing the precision of static analyses and control-flow integrity mechanisms in embedded systems. While previous work has primarily focused on resolving indirect jump targets, comparatively little attention has been devoted to understanding the reasons behind their generation. This paper presents a systematic empirical study of the origins of indirect jumps in compiled binaries. We introduce a taxonomy that characterizes the programming constructs and compiler transformations responsible for their generation. Our analysis encompasses C, C++, Fortran, and Rust programs compiled with GCC and LLVM at multiple optimization levels, targeting the 32-bit RISC-V instruction set. We then quantify the prevalence of each identified category over representative benchmarks and analyze differences across programming languages and compilation configurations. By clarifying the origins of indirect control transfers, this work provides insight into their impact on CFG precision and the static analysis of embedded software.