code: def _search_for_function_hints(self, successor_state):
          
  
          function_hints = []
  
          for action in successor_state.history.recent_actions:
              if action.type == 'reg' and action.offset == self.project.arch.ip_offset:
                  # Skip all accesses to IP registers
                  continue
              elif action.type == 'exit':
                  # only consider read/write actions
                  continue
  
              # Enumerate actions
              if isinstance(action, SimActionData):
                  data = action.data
                  if data is not None:
                      # TODO: Check if there is a proper way to tell whether this const falls in the range of code
                      # TODO: segments
                      # Now let's live with this big hack...
                      try:
                          const = successor_state.solver.eval_one(data.ast)
                      except:  # pylint: disable=bare-except
                          continue
  
                      if self._is_address_executable(const):
                          if self._pending_function_hints is not None and const in self._pending_function_hints:
                              continue
  
                          # target = const
                          # tpl = (None, None, target)
                          # st = self.project._simos.prepare_call_state(self.project.initial_state(mode='fastpath'),
                          #                                           initial_state=saved_state)
                          # st = self.project.initial_state(mode='fastpath')
                          # exits[tpl] = (st, None, None)
  
                          function_hints.append(const)
  
          l.debug('Got %d possible exits, including: %s', len(function_hints),
                 ", ".join(["0x%x" % f for f in function_hints])
                 )
  
          return function_hints
docs: Scan for constants that might be used as exit targets later, and add them into pending_exits.
  
          :param SimState successor_state: A successing state.
          :return:                                 A list of discovered code addresses.
          :rtype:                                  list