Can you give the corresponding entry point for the test sample you give?

[ffhgfv]

When I run the test sample you give, I can't find a solution using various entry points. Take "sodu" as an example. According to your article, the entry point is the instruction address that can be reached after triggering AWP. I set it as the address of the next "free" instruction of "vsprintf" corresponding to the format string vulnerability, but I can't find a solution. Can you give more entry points used for testing in your article, such as "proftpd" entry point, "sudo" entry point, "nginx" entry point, or elaborate on the discovery rules of entry points, or explain how you determine these entry points?

[alessandrobertani]

I have the same problem. I am trying to replicate the results of the paper, but BOPC always terminates with zero solutions found, no matter the configuration I'm using.
I also tried to use to use the entry point they specified in the paper (for nginx), but the result is always the same.
I too would appreciate if they could provide entry points or directions on how to find them.