Scan for constants that might be used as exit targets later, and add them into pending_exits.

        :param SimState successor_state: A successing state.
        :return:                                 A list of discovered code addresses.
        :rtype:                                  list

def _search_for_function_hints(self, successor_state):
        """
        Scan for constants that might be used as exit targets later, and add them into pending_exits.

        :param SimState successor_state: A successing state.
        :return:                                 A list of discovered code addresses.
        :rtype:                                  list
        """

        function_hints = []

        for action in successor_state.history.recent_actions:
            if action.type == 'reg' and action.offset == self.project.arch.ip_offset:
                # Skip all accesses to IP registers
                continue
            elif action.type == 'exit':
                # only consider read/write actions
                continue

            # Enumerate actions
            if isinstance(action, SimActionData):
                data = action.data
                if data is not None:
                    # TODO: Check if there is a proper way to tell whether this const falls in the range of code
                    # TODO: segments
                    # Now let's live with this big hack...
                    try:
                        const = successor_state.solver.eval_one(data.ast)
                    except:  # pylint: disable=bare-except
                        continue

                    if self._is_address_executable(const):
                        if self._pending_function_hints is not None and const in self._pending_function_hints:
                            continue

                        # target = const
                        # tpl = (None, None, target)
                        # st = self.project._simos.prepare_call_state(self.project.initial_state(mode='fastpath'),
                        #                                           initial_state=saved_state)
                        # st = self.project.initial_state(mode='fastpath')
                        # exits[tpl] = (st, None, None)

                        function_hints.append(const)

        l.debug('Got %d possible exits, including: %s', len(function_hints),
               ", ".join(["0x%x" % f for f in function_hints])
               )

        return function_hints