Instructions Rules Exploitable State
load %a, %b Address of %b is tainted AAW
store %a, %b Address of %b is tainted AAR
call func Address of func ptr is tainted CFH