Access the Symbolic Expressions

[br0kej]

Hey Folks,

I am currently experimenting with Maat and have a question I can't seem to answer on my own!

I am trying to implement Under-constrained Symbolic Execution (USE) using Maat's python API but with a twist. My understanding of USE is that it essentially executes SE over individual functions at arbitrary points rather than starting from main and following all possible paths.

I am using engine.run_from() to provide a starting address and the number of instructions to run. As a test, I have created a symbolic variable for one of the registers and executed it. I have also hooked the read/writes to registers and the hook prints the Symbolic expression as the execution progresses.

I'd like to know how to access the Symbolic expressions (ideally simplified) but can't seem to work out how to access them. I have tried to access the engine's path iterator but it seems to be empty. Any ideas?