tokens: We know that the asset ( program address register ) should only be controlled by the program counter ( PC ) and based on this assumption we apply our Malicious Control Point Identification technique .