Maybe try detecting/treating the packet handlers as separate "functions" and compare them by seeing if PME can run over both? Maybe try hardening PME mapper to fail more easily (eg setfield of field of two different types, or invoke with wrong signatures?), and then try and brute force methods in general. Can also map methods with unique signatures that are non static method<->method. client clinit?