diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 5c2afd6a58..78e8fb1b2f 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -70,92 +70,8 @@
 
 #include "libafl/hooks/tcg/block.h"
 #include "libafl/hooks/tcg/edge.h"
+#include "libafl/hooks/tcg/jmp.h"
 
-static TCGHelperInfo libafl_exec_jmp_hook_info = {
-    .func = NULL, .name = "libafl_exec_jmp_hook", \
-    .flags = dh_callflag(void), \
-    .typemask = dh_typemask(void, 0) | dh_typemask(tl, 1) | dh_typemask(tl, 2) | dh_typemask(i64, 3) | dh_typemask(i64, 4), \
-};
-
-struct libafl_jmp_hook {
-    uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst);
-    void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id);
-    uint64_t data;
-    TCGHelperInfo helper_info;
-    struct libafl_jmp_hook* next;
-};
-
-struct libafl_jmp_hook* libafl_jmp_hooks;
-
-void libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
-                          void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
-                          uint64_t data);
-void libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
-                          void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
-                          uint64_t data)
-{
-    struct libafl_jmp_hook* hook = calloc(sizeof(struct libafl_jmp_hook), 1);
-    hook->gen = gen;
-    hook->exec = exec;
-    hook->data = data;
-    hook->next = libafl_jmp_hooks;
-    libafl_jmp_hooks = hook;
-    
-    memcpy(&hook->helper_info, &libafl_exec_jmp_hook_info, sizeof(TCGHelperInfo));
-    hook->helper_info.func = exec;
-}
-
-void libafl_gen_jmp(target_ulong src, target_ulong dst);
-void libafl_gen_jmp(target_ulong src, target_ulong dst)
-{
-
-    struct libafl_jmp_hook* hook = libafl_jmp_hooks;
-    while (hook) {
-        uint64_t cur_id = 0;
-        if (hook->gen)
-            cur_id = hook->gen(hook->data, src, dst);
-        if (cur_id != (uint64_t)-1 && hook->exec) {
-            TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
-            TCGv_i64 tmp1 = tcg_constant_i64(src);
-            TCGv_i64 tmp2 = tcg_constant_i64(dst);
-            TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
-            TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) };
-            tcg_gen_callN(&hook->helper_info, NULL, tmp4);
-            tcg_temp_free_i64(tmp0);
-            tcg_temp_free_i64(tmp1);
-            tcg_temp_free_i64(tmp2);
-            tcg_temp_free_i64(tmp3);
-        }
-        hook = hook->next;
-    }
-}
-
-// Use an indirect jump target
-void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst);
-void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst)
-{
-    struct libafl_jmp_hook* hook = libafl_jmp_hooks;
-    while (hook) {
-        uint64_t cur_id = 0;
-        if (hook->gen)
-            cur_id = hook->gen(hook->data, src, 0);   // target is not statically known, signal with 0
-        if (cur_id != (uint64_t)-1 && hook->exec) {
-            TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
-            TCGv_i64 tmp1 = tcg_constant_i64(src);
-           // TCGv_i32 tmp2 = dst;
-            TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
-            TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i32_temp(dst), tcgv_i64_temp(tmp3) };
-            tcg_gen_callN(&hook->helper_info, NULL, tmp4);
-            tcg_temp_free_i64(tmp0);
-            tcg_temp_free_i64(tmp1);
-            //tcg_temp_free_i64(tmp2);
-            tcg_temp_free_i64(tmp3);
-        }
-        hook = hook->next;
-    }
-}
-
-#include "libafl/hook.h"
 //// --- End LibAFL code ---
 
 TBContext tb_ctx;
diff --git a/cpu-target.c b/cpu-target.c
index 3d72581f9a..4347488cb3 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -53,128 +53,6 @@
 #include "libafl/syx-snapshot/device-save.h"
 #endif
 
-void libafl_flush_jit(void);
-
-extern int libafl_restoring_devices;
-
-/*
-void* libafl_qemu_g2h(CPUState *cpu, target_ulong x);
-target_ulong libafl_qemu_h2g(CPUState *cpu, void* x);
-
-void* libafl_qemu_g2h(CPUState *cpu, target_ulong x)
-{
-    return g2h(cpu, x);
-}
-
-target_ulong libafl_qemu_h2g(CPUState *cpu, void* x)
-{
-    return h2g(cpu, x);
-}
-*/
-
-target_ulong libafl_page_from_addr(target_ulong addr) {
-    return addr & TARGET_PAGE_MASK;
-}
-
-CPUState* libafl_qemu_get_cpu(int cpu_index)
-{
-    CPUState *cpu;
-    CPU_FOREACH(cpu) {
-        if (cpu->cpu_index == cpu_index)
-            return cpu;
-    }
-    return NULL;
-}
-
-int libafl_qemu_num_cpus(void)
-{
-    CPUState *cpu;
-    int num = 0;
-    CPU_FOREACH(cpu) {
-        num++;
-    }
-    return num;
-}
-
-CPUState* libafl_qemu_current_cpu(void)
-{
-#ifndef CONFIG_USER_ONLY
-    if (current_cpu == NULL) {
-        return libafl_last_exit_cpu();
-    }
-#endif
-    return current_cpu;
-}
-
-int libafl_qemu_cpu_index(CPUState* cpu)
-{
-    if (cpu) return cpu->cpu_index;
-    return -1;
-}
-
-int libafl_qemu_write_reg(CPUState* cpu, int reg, uint8_t* val)
-{
-    return gdb_write_register(cpu, val, reg);
-}
-
-int libafl_qemu_read_reg(CPUState* cpu, int reg, uint8_t* val)
-{
-    int len;
-
-    if (libafl_qemu_mem_buf == NULL) {
-        libafl_qemu_mem_buf = g_byte_array_sized_new(64);
-    }
-
-    g_byte_array_set_size(libafl_qemu_mem_buf, 0);
-
-    len = gdb_read_register(cpu, libafl_qemu_mem_buf, reg);
-
-    if (len > 0) {
-        memcpy(val, libafl_qemu_mem_buf->data, len);
-    }
-
-    return len;
-}
-
-int libafl_qemu_num_regs(CPUState* cpu)
-{
-    CPUClass *cc = CPU_GET_CLASS(cpu);
-    return cc->gdb_num_core_regs;
-}
-
-#ifdef TARGET_ARM
-// use-case: get the user-stack pointer and return addr from at an isr-return
-#include "target/arm/cpu.h"
-#include "target/arm/internals.h"
-
-int libafl_qemu_read_user_sp_unchecked(CPUState* cpu);
-int libafl_qemu_read_user_sp_unchecked(CPUState* cpu) {
-    CPUARMState *env = cpu_env(cpu);
-    return env->v7m.other_sp;
-}
-
-#endif
-
-#ifndef CONFIG_USER_ONLY
-hwaddr libafl_qemu_current_paging_id(CPUState* cpu)
-{
-    CPUClass* cc = CPU_GET_CLASS(cpu);
-    if (cc->sysemu_ops && cc->sysemu_ops->get_paging_id) {
-        return cc->sysemu_ops->get_paging_id(cpu);
-    } else {
-        return 0;
-    }
-}
-#endif
-
-void libafl_flush_jit(void)
-{
-    CPUState *cpu;
-    CPU_FOREACH(cpu) {
-        tb_flush(cpu);
-    }
-}
-
 //// --- End LibAFL code ---
 
 #ifndef CONFIG_USER_ONLY
diff --git a/hw/timer/armv7m_systick.c b/hw/timer/armv7m_systick.c
index b062fb3790..b237a97193 100644
--- a/hw/timer/armv7m_systick.c
+++ b/hw/timer/armv7m_systick.c
@@ -316,23 +316,19 @@ type_init(armv7m_systick_register_types)
 #pragma GCC diagnostic ignored "-Wint-to-pointer-cast"
 #include "qemu/seqlock.h"
 #include "sysemu/cpu-timers-internal.h"
-#define NUM_INTERRUPT_SOURCES 6
-#define MAX_NUM_INTERRUPT 128
-extern void libafl_send_irq(int irqn);
-volatile uint32_t libafl_interrupt_offsets[NUM_INTERRUPT_SOURCES][MAX_NUM_INTERRUPT];
-volatile uint64_t libafl_num_interrupts[NUM_INTERRUPT_SOURCES] = {0};
-static ptimer_state* libafl_interrupt_timers[NUM_INTERRUPT_SOURCES][MAX_NUM_INTERRUPT] = {0};
+#include "libafl/interrupt_injection.h"
+volatile uint32_t libafl_interrupt_offsets[LIBAFL_MAX_INTERRUPT_SOURCES][LIBAFL_MAX_INTERRUPTS];
+volatile uint64_t libafl_num_interrupts[LIBAFL_MAX_INTERRUPT_SOURCES] = {0};
+static ptimer_state* libafl_interrupt_timers[LIBAFL_MAX_INTERRUPT_SOURCES][LIBAFL_MAX_INTERRUPTS] = {0};
 /* This can be moved to a helper function later */
-static void libafl_timed_int_hook(void*);
 static void libafl_timed_int_hook(void* arg)
 {
     libafl_send_irq((int)arg);
 }
-void libafl_start_int_timer( void );
 void libafl_start_int_timer( void ) {
-    for (int source=0; source<NUM_INTERRUPT_SOURCES; source++) {
+    for (int source=0; source<LIBAFL_MAX_INTERRUPT_SOURCES; source++) {
         if (libafl_num_interrupts[source] == 0) {continue;}
-        for (int i=0; i<libafl_num_interrupts[source] && i<MAX_NUM_INTERRUPT; i++) {
+        for (int i=0; i<libafl_num_interrupts[source] && i<LIBAFL_MAX_INTERRUPTS; i++) {
             if (libafl_interrupt_offsets[source][i] == 0) {continue;}
             if (!libafl_interrupt_timers[source][i]) {
                 libafl_interrupt_timers[source][i] = ptimer_init(&libafl_timed_int_hook, (void*)source, 0);
diff --git a/include/libafl/cpu.h b/include/libafl/cpu.h
index 856a745593..9b22508bd7 100644
--- a/include/libafl/cpu.h
+++ b/include/libafl/cpu.h
@@ -29,3 +29,7 @@ int libafl_qemu_main(void);
 int libafl_qemu_run(void);
 void libafl_set_qemu_env(CPUArchState* env);
 #endif
+
+#ifdef TARGET_ARM
+int libafl_qemu_read_user_sp_unchecked(CPUState* cpu);
+#endif
diff --git a/include/libafl/hook.h b/include/libafl/hook.h
index 7f8033d0cc..6add522880 100644
--- a/include/libafl/hook.h
+++ b/include/libafl/hook.h
@@ -57,214 +57,3 @@ extern target_ulong libafl_gen_cur_pc;
 extern size_t libafl_qemu_hooks_num;
 
 void libafl_tcg_gen_asan(TCGTemp* addr, size_t size);
-size_t libafl_qemu_set_hook(target_ulong pc, void (*callback)(uint64_t data, target_ulong pc),
-                            uint64_t data, int invalidate);
-size_t libafl_qemu_remove_hooks_at(target_ulong addr, int invalidate);
-int libafl_qemu_remove_hook(size_t num, int invalidate);
-struct libafl_hook* libafl_search_hook(target_ulong addr);
-
-struct libafl_backdoor_hook {
-    void (*exec)(uint64_t data, CPUArchState* cpu, target_ulong pc);
-    uint64_t data;
-    size_t num;
-    TCGHelperInfo helper_info;
-    struct libafl_backdoor_hook* next;
-};
-
-extern struct libafl_backdoor_hook* libafl_backdoor_hooks;
-
-size_t libafl_add_backdoor_hook(void (*exec)(uint64_t data, CPUArchState* cpu, target_ulong pc),
-                                uint64_t data);
-int libafl_qemu_remove_backdoor_hook(size_t num, int invalidate);
-
-struct libafl_edge_hook {
-    uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst);
-    // void (*exec)(uint64_t data, uint64_t id);
-    size_t (*jit)(uint64_t data, uint64_t id); // optional opt
-    uint64_t data;
-    size_t num;
-    uint64_t cur_id;
-    TCGHelperInfo helper_info;
-    struct libafl_edge_hook* next;
-};
-
-extern struct libafl_edge_hook* libafl_edge_hooks;
-
-size_t libafl_add_edge_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
-                            void (*exec)(uint64_t data, uint64_t id),
-                            uint64_t data);
-int libafl_qemu_remove_edge_hook(size_t num, int invalidate);
-bool libafl_qemu_edge_hook_set_jit(size_t num, size_t (*jit)(uint64_t, uint64_t)); // no param names to avoid to be marked as safe
-
-struct libafl_block_hook {
-    uint64_t (*gen)(uint64_t data, target_ulong pc);
-    void (*post_gen)(uint64_t data, target_ulong pc, target_ulong block_length);
-    // void (*exec)(uint64_t data, uint64_t id);
-    size_t (*jit)(uint64_t data, uint64_t id); // optional opt
-    uint64_t data;
-    size_t num;
-    TCGHelperInfo helper_info;
-    struct libafl_block_hook* next;
-};
-
-extern struct libafl_block_hook* libafl_block_hooks;
-
-size_t libafl_add_block_hook(uint64_t (*gen)(uint64_t data, target_ulong pc),
-                             void (*post_gen)(uint64_t data, target_ulong pc, target_ulong block_length),
-                             void (*exec)(uint64_t data, uint64_t id), uint64_t data);
-int libafl_qemu_remove_block_hook(size_t num, int invalidate);
-bool libafl_qemu_block_hook_set_jit(size_t num, size_t (*jit)(uint64_t, uint64_t)); // no param names to avoid to be marked as safe
-
-struct libafl_rw_hook {
-    uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp* addr, MemOpIdx oi);
-    /*void (*exec1)(uint64_t data, uint64_t id, target_ulong addr);
-    void (*exec2)(uint64_t data, uint64_t id, target_ulong addr);
-    void (*exec4)(uint64_t data, uint64_t id, target_ulong addr);
-    void (*exec8)(uint64_t data, uint64_t id, target_ulong addr);
-    void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size);*/
-    uint64_t data;
-    size_t num;
-    TCGHelperInfo helper_info1;
-    TCGHelperInfo helper_info2;
-    TCGHelperInfo helper_info4;
-    TCGHelperInfo helper_info8;
-    TCGHelperInfo helper_infoN;
-    struct libafl_rw_hook* next;
-};
-
-// alias
-#define libafl_read_hook libafl_rw_hook
-#define libafl_write_hook libafl_rw_hook
-
-extern struct libafl_rw_hook* libafl_read_hooks;
-extern struct libafl_rw_hook* libafl_write_hooks;
-
-size_t libafl_add_read_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp *addr, MemOpIdx oi),
-                             void (*exec1)(uint64_t data, uint64_t id, target_ulong addr),
-                             void (*exec2)(uint64_t data, uint64_t id, target_ulong addr),
-                             void (*exec4)(uint64_t data, uint64_t id, target_ulong addr),
-                             void (*exec8)(uint64_t data, uint64_t id, target_ulong addr),
-                             void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size),
-                             uint64_t data);
-size_t libafl_add_write_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, TCGTemp *addr, MemOpIdx oi),
-                             void (*exec1)(uint64_t data, uint64_t id, target_ulong addr),
-                             void (*exec2)(uint64_t data, uint64_t id, target_ulong addr),
-                             void (*exec4)(uint64_t data, uint64_t id, target_ulong addr),
-                             void (*exec8)(uint64_t data, uint64_t id, target_ulong addr),
-                             void (*execN)(uint64_t data, uint64_t id, target_ulong addr, size_t size),
-                             uint64_t data);
-
-int libafl_qemu_remove_read_hook(size_t num, int invalidate);
-int libafl_qemu_remove_write_hook(size_t num, int invalidate);
-
-void libafl_gen_read(TCGTemp *addr, MemOpIdx oi);
-void libafl_gen_write(TCGTemp *addr, MemOpIdx oi);
-
-struct libafl_cmp_hook {
-    uint64_t (*gen)(uint64_t data, target_ulong pc, size_t size);
-    /*void (*exec1)(uint64_t data, uint64_t id, uint8_t v0, uint8_t v1);
-    void (*exec2)(uint64_t data, uint64_t id, uint16_t v0, uint16_t v1);
-    void (*exec4)(uint64_t data, uint64_t id, uint32_t v0, uint32_t v1);
-    void (*exec8)(uint64_t data, uint64_t id, uint64_t v0, uint64_t v1);*/
-    uint64_t data;
-    size_t num;
-    TCGHelperInfo helper_info1;
-    TCGHelperInfo helper_info2;
-    TCGHelperInfo helper_info4;
-    TCGHelperInfo helper_info8;
-    struct libafl_cmp_hook* next;
-};
-
-extern struct libafl_cmp_hook* libafl_cmp_hooks;
-
-size_t libafl_add_cmp_hook(uint64_t (*gen)(uint64_t data, target_ulong pc, size_t size),
-                           void (*exec1)(uint64_t data, uint64_t id, uint8_t v0, uint8_t v1),
-                           void (*exec2)(uint64_t data, uint64_t id, uint16_t v0, uint16_t v1),
-                           void (*exec4)(uint64_t data, uint64_t id, uint32_t v0, uint32_t v1),
-                           void (*exec8)(uint64_t data, uint64_t id, uint64_t v0, uint64_t v1),
-                           uint64_t data);
-int libafl_qemu_remove_cmp_hook(size_t num, int invalidate);
-
-struct syshook_ret {
-    target_ulong retval;
-    bool skip_syscall;
-};
-
-struct libafl_pre_syscall_hook {
-    struct syshook_ret (*callback)(uint64_t data, int sys_num, target_ulong arg0,
-                                   target_ulong arg1, target_ulong arg2,
-                                   target_ulong arg3, target_ulong arg4,
-                                   target_ulong arg5, target_ulong arg6,
-                                   target_ulong arg7);
-    uint64_t data;
-    size_t num;
-    struct libafl_pre_syscall_hook* next;
-};
-
-struct libafl_post_syscall_hook {
-    target_ulong (*callback)(uint64_t data, target_ulong ret, int sys_num,
-                             target_ulong arg0, target_ulong arg1,
-                             target_ulong arg2, target_ulong arg3,
-                             target_ulong arg4, target_ulong arg5,
-                             target_ulong arg6, target_ulong arg7);
-    uint64_t data;
-    size_t num;
-    struct libafl_post_syscall_hook* next;
-};
-
-extern struct libafl_pre_syscall_hook* libafl_pre_syscall_hooks;
-extern struct libafl_post_syscall_hook* libafl_post_syscall_hooks;
-
-size_t libafl_add_pre_syscall_hook(struct syshook_ret (*callback)(
-                                     uint64_t data, int sys_num, target_ulong arg0,
-                                     target_ulong arg1, target_ulong arg2,
-                                     target_ulong arg3, target_ulong arg4,
-                                     target_ulong arg5, target_ulong arg6,
-                                     target_ulong arg7),
-                                   uint64_t data);
-size_t libafl_add_post_syscall_hook(target_ulong (*callback)(
-                                      uint64_t data, target_ulong ret, int sys_num,
-                                      target_ulong arg0, target_ulong arg1,
-                                      target_ulong arg2, target_ulong arg3,
-                                      target_ulong arg4, target_ulong arg5,
-                                      target_ulong arg6, target_ulong arg7),
-                                    uint64_t data);
-
-int libafl_qemu_remove_pre_syscall_hook(size_t num);
-int libafl_qemu_remove_post_syscall_hook(size_t num);
-
-struct libafl_new_thread_hook {
-    bool (*callback)(uint64_t data, uint32_t tid);
-    uint64_t data;
-    size_t num;
-    struct libafl_new_thread_hook* next;
-};
-
-extern struct libafl_new_thread_hook* libafl_new_thread_hooks;
-
-size_t libafl_add_new_thread_hook(bool (*callback)(uint64_t data, uint32_t tid),
-                                  uint64_t data);
-int libafl_qemu_remove_new_thread_hook(size_t num);
-
-void libafl_tcg_gen_asan(TCGTemp * addr, size_t size);
-
-struct libafl_jmp_hook {
-    uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst);
-    void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id);
-    uint64_t data;
-    size_t num;
-    TCGHelperInfo helper_info;
-    struct libafl_jmp_hook* next;
-};
-
-extern struct libafl_jmp_hook* libafl_jmp_hooks;
-
-size_t libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
-                          void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
-                          uint64_t data);
-
-void libafl_gen_jmp(target_ulong src, target_ulong dst);
-
-// Use an indirect jump target
-void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst);
-int libafl_qemu_remove_jmp_hook(size_t num, int invalidate);
diff --git a/include/libafl/hooks/tcg/jmp.h b/include/libafl/hooks/tcg/jmp.h
new file mode 100644
index 0000000000..765f636d15
--- /dev/null
+++ b/include/libafl/hooks/tcg/jmp.h
@@ -0,0 +1,31 @@
+#pragma once
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+
+#include "exec/exec-all.h"
+#include "exec/tb-flush.h"
+
+#include "libafl/exit.h"
+#include "libafl/hook.h"
+
+struct libafl_jmp_hook {
+    uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst);
+    void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id);
+    uint64_t data;
+    size_t num;
+    TCGHelperInfo helper_info;
+    struct libafl_jmp_hook* next;
+};
+
+extern struct libafl_jmp_hook* libafl_jmp_hooks;
+
+size_t libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
+                          void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
+                          uint64_t data);
+
+void libafl_gen_jmp(target_ulong src, target_ulong dst);
+
+// Use an indirect jump target
+void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst);
+int libafl_qemu_remove_jmp_hook(size_t num, int invalidate);
\ No newline at end of file
diff --git a/libafl/cpu.c b/libafl/cpu.c
index 55b699c45e..8d6ced37e3 100644
--- a/libafl/cpu.c
+++ b/libafl/cpu.c
@@ -158,3 +158,15 @@ int libafl_qemu_run(void)
 
 void libafl_set_qemu_env(CPUArchState* env) { libafl_qemu_env = env; }
 #endif
+
+#ifdef TARGET_ARM
+// use-case: get the user-stack pointer and return addr from at an isr-return
+#include "target/arm/cpu.h"
+#include "target/arm/internals.h"
+
+int libafl_qemu_read_user_sp_unchecked(CPUState* cpu) {
+    CPUARMState *env = cpu_env(cpu);
+    return env->v7m.other_sp;
+}
+
+#endif
\ No newline at end of file
diff --git a/libafl/hook.c b/libafl/hook.c
index 084a97dab0..03dc93cdcc 100644
--- a/libafl/hook.c
+++ b/libafl/hook.c
@@ -64,78 +64,3 @@ void libafl_tcg_gen_asan(TCGTemp* addr, size_t size)
     tcg_gen_tl_ptr(test_ptr, test_addr);
     tcg_gen_st8_tl(shadow_val, test_ptr, 0);
 }
-
-static TCGHelperInfo libafl_exec_jmp_hook_info = {
-    .func = NULL, .name = "libafl_exec_jmp_hook", \
-    .flags = dh_callflag(void), \
-    .typemask = dh_typemask(void, 0) | dh_typemask(tl, 1) | dh_typemask(tl, 2) | dh_typemask(i64, 3) | dh_typemask(i64, 4), \
-};
-
-struct libafl_jmp_hook* libafl_jmp_hooks;
-size_t libafl_jmp_hooks_num = 0;
-
-size_t libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
-                          void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
-                          uint64_t data)
-{
-    struct libafl_jmp_hook* hook = calloc(sizeof(struct libafl_jmp_hook), 1);
-    hook->gen = gen;
-    hook->exec = exec;
-    hook->num = libafl_edge_hooks_num++;
-    hook->data = data;
-    hook->next = libafl_jmp_hooks;
-    libafl_jmp_hooks = hook;
-    
-    memcpy(&hook->helper_info, &libafl_exec_jmp_hook_info, sizeof(TCGHelperInfo));
-    hook->helper_info.func = exec;
-    return hook->num;
-}
-
-void libafl_gen_jmp(target_ulong src, target_ulong dst)
-{
-
-    struct libafl_jmp_hook* hook = libafl_jmp_hooks;
-    while (hook) {
-        uint64_t cur_id = 0;
-        if (hook->gen)
-            cur_id = hook->gen(hook->data, src, dst);
-        if (cur_id != (uint64_t)-1 && hook->exec) {
-            TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
-            TCGv_i64 tmp1 = tcg_constant_i64(src);
-            TCGv_i64 tmp2 = tcg_constant_i64(dst);
-            TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
-            TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) };
-            tcg_gen_callN(&hook->helper_info, NULL, tmp4);
-            tcg_temp_free_i64(tmp0);
-            tcg_temp_free_i64(tmp1);
-            tcg_temp_free_i64(tmp2);
-            tcg_temp_free_i64(tmp3);
-        }
-        hook = hook->next;
-    }
-}
-
-void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst)
-{
-    struct libafl_jmp_hook* hook = libafl_jmp_hooks;
-    while (hook) {
-        uint64_t cur_id = 0;
-        if (hook->gen)
-            cur_id = hook->gen(hook->data, src, 0);   // target is not statically known, signal with 0
-        if (cur_id != (uint64_t)-1 && hook->exec) {
-            TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
-            TCGv_i64 tmp1 = tcg_constant_i64(src);
-           // TCGv_i32 tmp2 = dst;
-            TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
-            TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i32_temp(dst), tcgv_i64_temp(tmp3) };
-            tcg_gen_callN(&hook->helper_info, NULL, tmp4);
-            tcg_temp_free_i64(tmp0);
-            tcg_temp_free_i64(tmp1);
-            //tcg_temp_free_i64(tmp2);
-            tcg_temp_free_i64(tmp3);
-        }
-        hook = hook->next;
-    }
-}
-
-GEN_REMOVE_HOOK(jmp)
\ No newline at end of file
diff --git a/libafl/hooks/tcg/jmp.c b/libafl/hooks/tcg/jmp.c
new file mode 100644
index 0000000000..84fd42dea0
--- /dev/null
+++ b/libafl/hooks/tcg/jmp.c
@@ -0,0 +1,78 @@
+#include "libafl/tcg.h"
+#include "libafl/hooks/tcg/jmp.h"
+
+static TCGHelperInfo libafl_exec_jmp_hook_info = {
+    .func = NULL,
+    .name = "libafl_exec_jmp_hook",
+    .flags = dh_callflag(void),
+    .typemask = dh_typemask(void, 0) | dh_typemask(tl, 1) | dh_typemask(tl, 2) | dh_typemask(i64, 3) | dh_typemask(i64, 4),
+};
+
+struct libafl_jmp_hook* libafl_jmp_hooks;
+size_t libafl_jmp_hooks_num = 0;
+
+size_t libafl_add_jmp_hook(uint64_t (*gen)(uint64_t data, target_ulong src, target_ulong dst),
+                          void (*exec)(uint64_t data, target_ulong src, target_ulong dst, uint64_t id),
+                          uint64_t data)
+{
+    struct libafl_jmp_hook* hook = calloc(sizeof(struct libafl_jmp_hook), 1);
+    hook->gen = gen;
+    hook->exec = exec;
+    hook->num = libafl_jmp_hooks_num++;
+    hook->data = data;
+    hook->next = libafl_jmp_hooks;
+    libafl_jmp_hooks = hook;
+
+    memcpy(&hook->helper_info, &libafl_exec_jmp_hook_info, sizeof(TCGHelperInfo));
+    hook->helper_info.func = exec;
+    return hook->num;
+}
+
+void libafl_gen_jmp(target_ulong src, target_ulong dst)
+{
+
+    struct libafl_jmp_hook* hook = libafl_jmp_hooks;
+    while (hook) {
+        uint64_t cur_id = 0;
+        if (hook->gen)
+            cur_id = hook->gen(hook->data, src, dst);
+        if (cur_id != (uint64_t)-1 && hook->exec) {
+            TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
+            TCGv_i64 tmp1 = tcg_constant_i64(src);
+            TCGv_i64 tmp2 = tcg_constant_i64(dst);
+            TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
+            TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i64_temp(tmp2), tcgv_i64_temp(tmp3) };
+            tcg_gen_callN(hook->helper_info.func, &hook->helper_info, NULL, tmp4);
+            tcg_temp_free_i64(tmp0);
+            tcg_temp_free_i64(tmp1);
+            tcg_temp_free_i64(tmp2);
+            tcg_temp_free_i64(tmp3);
+        }
+        hook = hook->next;
+    }
+}
+
+void libafl_gen_jmp_dynamic(target_ulong src, TCGv_i32 dst)
+{
+    struct libafl_jmp_hook* hook = libafl_jmp_hooks;
+    while (hook) {
+        uint64_t cur_id = 0;
+        if (hook->gen)
+            cur_id = hook->gen(hook->data, src, 0);   // target is not statically known, signal with 0
+        if (cur_id != (uint64_t)-1 && hook->exec) {
+            TCGv_i64 tmp0 = tcg_constant_i64(hook->data);
+            TCGv_i64 tmp1 = tcg_constant_i64(src);
+           // TCGv_i32 tmp2 = dst;
+            TCGv_i64 tmp3 = tcg_constant_i64(cur_id);
+            TCGTemp *tmp4[4] = { tcgv_i64_temp(tmp0), tcgv_i64_temp(tmp1), tcgv_i32_temp(dst), tcgv_i64_temp(tmp3) };
+            tcg_gen_callN(hook->helper_info.func, &hook->helper_info, NULL, tmp4);
+            tcg_temp_free_i64(tmp0);
+            tcg_temp_free_i64(tmp1);
+            //tcg_temp_free_i64(tmp2);
+            tcg_temp_free_i64(tmp3);
+        }
+        hook = hook->next;
+    }
+}
+
+GEN_REMOVE_HOOK(jmp)
\ No newline at end of file
diff --git a/libafl/meson.build b/libafl/meson.build
index b6d1dc52e0..cfe9c0ed1b 100644
--- a/libafl/meson.build
+++ b/libafl/meson.build
@@ -12,6 +12,7 @@ specific_ss.add(files(
                     'hooks/tcg/cmp.c',
                     'hooks/tcg/edge.c',
                     'hooks/tcg/instruction.c',
+                    'hooks/tcg/jmp.c',
                     'hooks/tcg/read_write.c',
 
                     # General hooks