[avianes]

> There are many issues in determining what is code, where are the branch destinations in case of indirect branches, etc.

Yes, handling indrect branch seems a bit complex and I'm not a specialist in the field. But I'm pretty sure that the cases of indirect branch are rare enough so that an additional indirection is relatively inexpensive. Adding a simple address mapping table should meet most of the cases.

An interesting question would also be whether Apple has added features to the hardware to improve the translation?

We know, for example, that Apple introduced a special register [1] to temporarily switch from the ARM consistency model to the TSO consistency model (Total Store Order) from x86.

[1] : https://github.com/saagarjha/TSOEnabler

[marcan_42]

C++ code with virtuals is basically all indirect branches for method calls.