'When an IRSB has more than two exits (for example, a jumptable), we
cannot concretize their exits in concrete mode. Hence we statically
execute the function from beginning in this method, and then switch to
symbolic mode for the final IRSB to get all possible exits of that
IRSB.'

def _symbolic_reconnoiter(self, addr, target_addr, max_depth=10):

    state = self.project.factory.blank_state(addr=addr, mode='symbolic', add_options={o.CALLLESS})
    initial_exit = self.project.factory.path(state)
    explorer = Explorer(self.project, start=initial_exit, max_depth=max_depth, find=target_addr, num_find=1).run()
    if (len(explorer.found) > 0):
        path = explorer.found[0]
        last_run = path.last_run
        return last_run.flat_exits()
    else:
        return []
