How to find path constaint that are not using symbolic values ? about angr HOT 3 CLOSED

For different reason I am not realy interested in making the value it using in the condition symbolic

Honestly making the value symbolic and concretizing it to its original concrete value immediately after is the easiest way, if you are thinking of using dynamic symbolic execution here.

If you want to do static analysis, you can also run RDA (or your own data-flow analysis) on the entire function, figure out the dependencies out of tmp_len, and get all expressions and statements that depend on tmp_len.

from angr.

Oh if you are thinking of analyzing source code instead of analyzing binary code, angr is not the best choice.

from angr.

For different reason I am not realy interested in making the value it using in the condition symbolic

Honestly making the value symbolic and concretizing it to its original concrete value immediately after is the easiest way, if you are thinking of using dynamic symbolic execution here.

If you want to do static analysis, you can also run RDA (or your own data-flow analysis) on the entire function, figure out the dependencies out of tmp_len, and get all expressions and statements that depend on tmp_len.

It is in fact for dynamic symbolic execution. I am not supposed to have the source code. It a basis to experiment around.
So basically I have to found in which register the value is hold, transform it as symbolic, stepping, recovering the condition and then reconcretize the value ?

from angr.