(ptr % 2) == 1 checks if the least significant bit of the pointer is set (i.e. if the pointer points to a THUMB function).
addr = Dword(p) reads 4 bytes which are treated then as a pointer to an ARM or THUMB function.
So those two places work as I wanted, no mistakes here
There are other mistakes, however.
All integers are signed in IDA script, so for(p = (min + 3) & (~3); max >= p && max - p >= 4; p = p + 4) is going to end too early if (unsigned)max>=0x80000000 and (unsigned)min<0x80000000.
Bookmarks