(self, successor_state)
return function_hints
Scan for constants that might be used as exit targets later, and add them into pending_exits.

        :param SimState successor_state: A successing state.
        :return:                                 A list of discovered code addresses.
        :rtype:                                  list
Scan for constants that might be used as exit targets later, and add them into pending_exits.
Scan for constants that might be used as exit targets later and add them into pending_exits .
def _search_for_function_hints(self, successor_state):
        """
        Scan for constants that might be used as exit targets later, and add them into pending_exits.

        :param SimState successor_state: A successing state.
        :return:                                 A list of discovered code addresses.
        :rtype:                                  list
        """

        function_hints = []

        for action in successor_state.history.recent_actions:
            if action.type == 'reg' and action.offset == self.project.arch.ip_offset:
                # Skip all accesses to IP registers
                continue
            elif action.type == 'exit':
                # only consider read/write actions
                continue

            # Enumerate actions
            if isinstance(action, SimActionData):
                data = action.data
                if data is not None:
                    # TODO: Check if there is a proper way to tell whether this const falls in the range of code
                    # TODO: segments
                    # Now let's live with this big hack...
                    try:
                        const = successor_state.solver.eval_one(data.ast)
                    except:  # pylint: disable=bare-except
                        continue

                    if self._is_address_executable(const):
                        if self._pending_function_hints is not None and const in self._pending_function_hints:
                            continue

                        # target = const
                        # tpl = (None, None, target)
                        # st = self.project._simos.prepare_call_state(self.project.initial_state(mode='fastpath'),
                        #                                           initial_state=saved_state)
                        # st = self.project.initial_state(mode='fastpath')
                        # exits[tpl] = (st, None, None)

                        function_hints.append(const)

        l.debug('Got %d possible exits, including: %s', len(function_hints),
               ", ".join(["0x%x" % f for f in function_hints])
               )

        return function_hints
def _search_for_function_hints ( self , successor_state ) : function_hints = [ ] for action in successor_state . history . recent_actions : if action . type == 'reg' and action . offset == self . project . arch . ip_offset : # Skip all accesses to IP registers continue elif action . type == 'exit' : # only consider read/write actions continue # Enumerate actions if isinstance ( action , SimActionData ) : data = action . data if data is not None : # TODO: Check if there is a proper way to tell whether this const falls in the range of code # TODO: segments # Now let's live with this big hack... try : const = successor_state . solver . eval_one ( data . ast ) except : # pylint: disable=bare-except continue if self . _is_address_executable ( const ) : if self . _pending_function_hints is not None and const in self . _pending_function_hints : continue # target = const # tpl = (None, None, target) # st = self.project._simos.prepare_call_state(self.project.initial_state(mode='fastpath'), #                                           initial_state=saved_state) # st = self.project.initial_state(mode='fastpath') # exits[tpl] = (st, None, None) function_hints . append ( const ) l . debug ( 'Got %d possible exits, including: %s' , len ( function_hints ) , ", " . join ( [ "0x%x" % f for f in function_hints ] ) ) return function_hints