In the most basic words using symbolic execution we can tell it(angr) to go explore each and every path of the binary provided until it errors out or completes execution(deadend). After the execution completes, the manager contains a list of all the states, from those states we are only interested in the ones which executed successfully, ie deadend, then we iterate through each & every state & check if the input given contains the flag's initial character, if so that is our input that we are looking for. Hope it helps