Handling Multiple Paths in a Function

[NicolaasWeideman]

A function with multiple paths will result in multiple dead ended states after symbolic execution.
Each of these will have its own return value.
At the moment, we combine these into a claripy.Or operation (here) and take this as the symbolic return expression of the function.

In retrospect, I don't think this makes sense.
One possible alternative approach is that we create multiple ExtractedSymExpr objects (one per return state) and return all of these for SymbolicExpressionExtractor.extract.

However, since SymbolicExpressionExtractor.extract is a pretty central part to the project, we may want to think what the best way forward is.

[NicolaasWeideman]

An alternative is to combine all paths into a single ExtractedSymExpr by using the claripy.ast.bool.If operator.
The return state of each path will have a number of path constraints and its return expression.
Recursively, we create an If expression where the condition expression is the path constraints of the state, the "then" expression is the return expression and the "else" expression is the If expression of the next path.
The dev/if_then_else_extracted_expressions branch shows the basic idea. On this branch, the if_then_else_example.py script can be used to see an example.

@spencerwuwu this is what I was getting at in last week's meeting. Let me know what you think.

[spencerwuwu]

Yeah. I actually managed to find the right way of merging state conditions this weekend.
I'm creating a PR now.