IIUC, you could probably use KLEE to ease the pain of capturing the state.

http://klee.github.io/