[DynInst_API:] BPatch_dynamicTargetExpr on return statements

[Marc BrÃnink <marc@xxxxxxxxx>]

Dear all,

I am trying to understand BPatch_dynamicTargetExpr. Things I did:

1. Create an empty function.
   function (0x4015b9)
     Basic Block (4015b9 to 4015bf) (entry: 1) (exit: 1):
       4015b9  push RBP, RSP
       4015ba  mov RBP, RSP
       4015bd  pop RBP, RSP
       4015be  ret near [RSP]

2. Find the single exit point of the empty function.
   It is 4015be.

3. Insert a snippet to a function that receives a void* and print it.
   Pass dynamicTargetExpr() as argument

4. Alternative to 3:
    BPatchSnippetHandle* handle = process->insertSnippet(
       BPatch_arithExpr(BPatch_assign, *v, BPatch_dynamicTargetExpr()),
                                        *exit_points,
                                        BPatch_callAfter);
   with v being a BPatch_variableExpr that is a static void*.

I expected to get the target of the return.
I got pretty much random values.

Currently I am using the little bit outdated version 5d54538 from 15th 
April.
Questions:
1. Can I use dynamicTargetExpr on return statements?
2. If yes, how to use dynamicTargetExpr?
3. What constraints exist regarding the usage of dynamicTargetExpr?
4. Is this a known issue that is fixed in newer version?

Marc