@Test
	public void testReadStateMemory() throws Throwable {
		try (ToyDBTraceBuilder tb = new ToyDBTraceBuilder("Test", "x86:LE:64:default")) {
			TraceThread thread = initTrace(tb, "", List.of());

			try (Transaction tx = tb.startTransaction()) {
				TracePropertyMap<String> taintMap = tb.trace.getAddressPropertyManager()
						.getOrCreatePropertyMap("Taint", String.class);
				taintMap.set(Lifespan.nowOn(0), tb.range(0x00400000, 0x00400003), "test_0");
			}

			TaintTracePcodeEmulator emu = new TaintTracePcodeEmulator(tb.host, 0);
			PcodeThread<Pair<byte[], TaintVec>> emuThread = emu.newThread(thread.getPath());
			emuThread.getExecutor().executeSleigh("RAX = *0x00400000:8;");

			Pair<byte[], TaintVec> valRAX =
				emuThread.getState().getVar(tb.language.getRegister("RAX"), Reason.INSPECT);
			TaintVec exp = TaintVec.empties(8);
			TaintSet testTaint = TaintSet.of(new TaintMark("test_0", Set.of()));
			for (int i = 0; i < 4; i++) {
				exp.set(i, testTaint);
			}
			assertEquals(exp, valRAX.getRight());
		}
	}
Test that state is properly read from trace memory

<p>
We isolate exactly a read by executing sleigh.
Ghidra/Debug/TaintAnalysis/src/test/java/ghidra/pcode/emu/taint/trace/TaintTracePcodeEmulatorTest.java