angr/analyses/girlscout.py
def _symbolic_reconnoiter(self, addr, target_addr, max_depth=10):
        """
        When an IRSB has more than two exits (for example, a jumptable), we
        cannot concretize their exits in concrete mode. Hence we statically
        execute the function from beginning in this method, and then switch to
        symbolic mode for the final IRSB to get all possible exits of that
        IRSB.
        """
        state = self.project.factory.blank_state(addr=addr,
                                                  mode="symbolic",
                                                  add_options={o.CALLLESS}
                                                 )
        initial_exit = self.project.factory.path(state)
        explorer = Explorer(self.project,
                            start=initial_exit,
                            max_depth=max_depth,
                            find=(target_addr), num_find=1).run()
        if len(explorer.found) > 0:
            path = explorer.found[0]
            last_run = path.last_run
            return last_run.flat_exits()
        else:
            return []

        When an IRSB has more than two exits (for example, a jumptable), we
        cannot concretize their exits in concrete mode. Hence we statically
        execute the function from beginning in this method, and then switch to
        symbolic mode for the final IRSB to get all possible exits of that
        IRSB.
        
When an IRSB has more than two exits (for example, a jumptable), we
cannot concretize their exits in concrete mode. Hence we statically
execute the function from beginning in this method, and then switch to
symbolic mode for the final IRSB to get all possible exits of that
IRSB.
When an IRSB has more than two exits ( for example a jumptable ) we cannot concretize their exits in concrete mode . Hence we statically execute the function from beginning in this method and then switch to symbolic mode for the final IRSB to get all possible exits of that IRSB .
def _symbolic_reconnoiter(self, addr, target_addr, max_depth=10):
        state = self.project.factory.blank_state(addr=addr,
                                                  mode="symbolic",
                                                  add_options={o.CALLLESS}
                                                 )
        initial_exit = self.project.factory.path(state)
        explorer = Explorer(self.project,
                            start=initial_exit,
                            max_depth=max_depth,
                            find=(target_addr), num_find=1).run()
        if len(explorer.found) > 0:
            path = explorer.found[0]
            last_run = path.last_run
            return last_run.flat_exits()
        else:
            return []
def _symbolic_reconnoiter ( self , addr , target_addr , max_depth = 10 ) : state = self . project . factory . blank_state ( addr = addr , mode = "symbolic" , add_options = { o . CALLLESS } ) initial_exit = self . project . factory . path ( state ) explorer = Explorer ( self . project , start = initial_exit , max_depth = max_depth , find = ( target_addr ) , num_find = 1 ) . run ( ) if len ( explorer . found ) > 0 : path = explorer . found [ 0 ] last_run = path . last_run return last_run . flat_exits ( ) else : return [ ]
When an IRSB has more than two exits (for example, a jumptable), we
cannot concretize their exits in concrete mode.
When an IRSB has more than two exits ( for example a jumptable ) we cannot concretize their exits in concrete mode .
"""
        When an IRSB has more than two exits (for example, a jumptable), we
        cannot concretize their exits in concrete mode. Hence we statically
        execute the function from beginning in this method, and then switch to
        symbolic mode for the final IRSB to get all possible exits of that
        IRSB.
        """
self
addr
target_addr
max_depth