@joxean The order they are called in is a good heuristic, but you probably have enough information to match code structures beyond that.

You would need to use the basic block structure of the caller to differentiate call sites, since "first" is only trivial in a linear function with no branches.

You're decompiling, which should allow you to match the call sites in the AST or an intermediate representation (IR), independent of the arch.

#AST #IR #BinaryDiffing #BasicBlock