Ferry: State-Aware Symbolic Execution for Exploring State-Dependent Program Paths