code: def _symbolic_reconnoiter(self, addr, target_addr, max_depth=10):
          
          state = self.project.factory.blank_state(addr=addr,
                                                    mode="symbolic",
                                                    add_options={o.CALLLESS}
                                                   )
          initial_exit = self.project.factory.path(state)
          explorer = Explorer(self.project,
                              start=initial_exit,
                              max_depth=max_depth,
                              find=(target_addr), num_find=1).run()
          if len(explorer.found) > 0:
              path = explorer.found[0]
              last_run = path.last_run
              return last_run.flat_exits()
          else:
              return []
docs: When an IRSB has more than two exits (for example, a jumptable), we
          cannot concretize their exits in concrete mode. Hence we statically
          execute the function from beginning in this method, and then switch to
          symbolic mode for the final IRSB to get all possible exits of that
          IRSB.