// File: /workspace/github_cpp_makefile_star2_O3/DimitriFourny[P]uaf_replacer/main.cc
// Function: main
int main(int argc, char* argv[]) {
  if (argc < 2) {
    printf("Usage: %s <json_path> [object_size]\n", argv[0]);
    printf("       %s <json_path> <min_size> <max_size>\n", argv[0]);
    return 1;
  }

  std::string filepath = argv[1];
  bool search_exact_size = false;
  unsigned int target_object_size = 0;
  bool search_range_size = false;
  unsigned int min_size = 0, max_size = 0;
  if (argc == 3) {
    search_exact_size = true;
    target_object_size = std::stoul(argv[2], nullptr, 0);
  } else if (argc > 3) {
    search_range_size = true;
    min_size = std::stoul(argv[2], nullptr, 0);
    max_size = std::stoul(argv[3], nullptr, 0);
  }

  printf("Mapping the file...");
  fflush(stdout);
  size_t filesize = 0;
  char* memfile = map_file(filepath, filesize);
  if (!memfile) {
    return 2;
  }
  memfile[filesize] = 0;
  printf("done\n");

  printf("Mapping the JSON...");
  fflush(stdout);
  rapidjson::Document document;
  document.Parse(memfile);
  if (document.HasParseError()) {
    printf("parsing error\n");
    printf("Error: %s (%zd)\n", GetParseError_En(document.GetParseError()), 
      document.GetErrorOffset());
    free(memfile);
    return 3;
  }
  printf("done\n");
  free(memfile);

  if (search_exact_size) {
    printf("Searching objects of size 0x%x bytes...\n", target_object_size);
  } else if (search_range_size) {
    printf("Searching objects in the range [0x%x, 0x%x] bytes...\n", 
      min_size, max_size);
  }
  printf("\n--------------------\n");

  size_t nb_found = 0;
  for (rapidjson::Value::ConstMemberIterator itr = document.MemberBegin(); 
       itr != document.MemberEnd(); ++itr) {
    if (!itr->value.HasMember("name") || !itr->value.HasMember("type")
        || !itr->value.HasMember("size")) {
      continue; 
    }

    if (search_exact_size) {
      if (itr->value["size"].GetUint() != target_object_size) {
        continue;
      }
    } else if (search_range_size) {
      if (itr->value["size"].GetUint() < min_size ||
          itr->value["size"].GetUint() > max_size) {
        continue;
      }
    }

    printf("%s %s (0x%x bytes)\n", itr->value["type"].GetString(), 
      itr->value["name"].GetString(), itr->value["size"].GetUint());
    nb_found++;
    
    if (itr->value.HasMember("members")) {
      dump_members(document, itr->value, itr->value["members"], 0, 0);
    }
    printf("--------------------\n");
  }

  printf("\n%zu objects found\n", nb_found);
  return 0;
}

// Assembly:
pushq %rbp
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0xc8, %rsp
movq %rsi, %r15
cmpl $0x1, %edi
jg 0x3cc6
movq (%r15), %rsi
leaq 0x345a(%rip), %rdi      # 0x70fe
xorl %eax, %eax
callq 0x2050
movq (%r15), %rsi
leaq 0x346e(%rip), %rdi      # 0x7123
xorl %eax, %eax
callq 0x2050
movl $0x1, %ebx
jmp 0x42aa
movl %edi, %r13d
movq 0x8(%r15), %rsi
leaq 0xa8(%rsp), %rdi
leaq 0x40(%rsp), %rdx
callq 0x46de
cmpl $0x3, %r13d
jne 0x3d4e
movq 0x10(%r15), %rsi
leaq 0x40(%rsp), %rdi
leaq 0x18(%rsp), %rdx
callq 0x46de
movq 0x40(%rsp), %r15
callq 0x2040
movq %rax, %r14
movl (%rax), %ebp
movl $0x0, (%rax)
leaq 0x20(%rsp), %r12
movq %r15, %rdi
movq %r12, %rsi
xorl %edx, %edx
callq 0x2090
movq %rax, 0x10(%rsp)
cmpq %r15, (%r12)
je 0x42dd
movl (%r14), %eax
testl %eax, %eax
je 0x3dda
cmpl $0x22, %eax
jne 0x3ddd
leaq 0x34c7(%rip), %rdi      # 0x7210
callq 0x21f0
movq $0x0, 0x10(%rsp)
movl $0x0, 0x8(%rsp)
movl $0x0, %r12d
movl $0x0, %ebp
cmpl $0x4, %r13d
jb 0x3eb4
movl %r13d, 0xc(%rsp)
movq 0x10(%r15), %rsi
leaq 0x40(%rsp), %rdi
leaq 0x18(%rsp), %rdx
callq 0x46de
movq 0x40(%rsp), %r12
callq 0x2040
movq %rax, %r14
movl (%rax), %ebp
movl $0x0, (%rax)
leaq 0x20(%rsp), %r13
movq %r12, %rdi
movq %r13, %rsi
xorl %edx, %edx
callq 0x2090
movq %rax, 0x30(%rsp)
cmpq %r12, (%r13)
je 0x42e9
movl (%r14), %eax
testl %eax, %eax
je 0x3e0a
cmpl $0x22, %eax
jne 0x3e0d
leaq 0x343b(%rip), %rdi      # 0x7210
callq 0x21f0
movl %ebp, (%r14)
leaq 0x50(%rsp), %rax
movq -0x10(%rax), %rdi
cmpq %rax, %rdi
je 0x3df8
movq 0x50(%rsp), %rsi
incq %rsi
callq 0x2140
movl $0x0, 0x8(%rsp)
xorl %r12d, %r12d
xorl %ebp, %ebp
jmp 0x3eb4
movl %ebp, (%r14)
leaq 0x50(%rsp), %r13
movq -0x10(%r13), %rdi
cmpq %r13, %rdi
je 0x3e28
movq 0x50(%rsp), %rsi
incq %rsi
callq 0x2140
movq 0x18(%r15), %rsi
leaq 0x40(%rsp), %rdi
leaq 0x18(%rsp), %rdx
callq 0x46de
movq 0x40(%rsp), %r15
movl (%r14), %ebx
movl $0x0, (%r14)
leaq 0x20(%rsp), %r12
movq %r15, %rdi
movq %r12, %rsi
xorl %edx, %edx
callq 0x2090
cmpq %r15, (%r12)
je 0x42f5
movq %rax, %rbp
movl (%r14), %eax
testl %eax, %eax
je 0x3e81
cmpl $0x22, %eax
jne 0x3e84
leaq 0x3394(%rip), %rdi      # 0x7210
callq 0x21f0
movl %ebx, (%r14)
movq 0x40(%rsp), %rdi
cmpq %r13, %rdi
je 0x3e9b
movq 0x50(%rsp), %rsi
incq %rsi
callq 0x2140
movb $0x1, %al
movl %eax, 0x8(%rsp)
movq $0x0, 0x10(%rsp)
movl 0xc(%rsp), %r13d
movq 0x30(%rsp), %r12
leaq 0x3295(%rip), %rdi      # 0x7150
xorl %eax, %eax
callq 0x2050
movq 0x90f7(%rip), %rbx      # 0xcfc0
movq (%rbx), %rdi
callq 0x2190
leaq 0x18(%rsp), %rsi
movq $0x0, (%rsi)
leaq 0xa8(%rsp), %rdi
callq 0x2c4c
testq %rax, %rax
je 0x3f7e
movq %rax, %r14
movq 0x18(%rsp), %rax
movb $0x0, (%r14,%rax)
leaq 0x5547(%rip), %rdi      # 0x944e
callq 0x2220
leaq 0x3251(%rip), %rdi      # 0x7164
xorl %eax, %eax
callq 0x2050
movq (%rbx), %rdi
callq 0x2190
leaq 0x40(%rsp), %rdi
movl $0x400, %edx            # imm = 0x400
xorl %esi, %esi
xorl %ecx, %ecx
callq 0x48ea
leaq 0x20(%rsp), %rsi
movq %r14, (%rsi)
movq %r14, 0x8(%rsi)
leaq 0x40(%rsp), %rdi
callq 0x4f12
cmpl $0x0, 0x90(%rsp)
je 0x3f88
leaq 0x550d(%rip), %rdi      # 0x9469
callq 0x2220
movl 0x90(%rsp), %eax
cmpq $0x11, %rax
ja 0x3fb7
leaq 0x6093(%rip), %rcx      # 0xa008
movslq (%rcx,%rax,4), %rsi
addq %rcx, %rsi
jmp 0x3fbe
movl $0x2, %ebx
jmp 0x4289
leaq 0x54bf(%rip), %rdi      # 0x944e
callq 0x2220
movq %r14, %rdi
callq 0x21b0
cmpl $0x3, %r13d
jne 0x3fe6
leaq 0x31e0(%rip), %rdi      # 0x7189
movq 0x10(%rsp), %rsi
xorl %eax, %eax
callq 0x2050
jmp 0x4000
leaq 0x34d2(%rip), %rsi      # 0x7490
movq 0x98(%rsp), %rdx
leaq 0x31ab(%rip), %rdi      # 0x7178
xorl %eax, %eax
callq 0x2050
movq %r14, %rdi
callq 0x21b0
movl $0x3, %ebx
jmp 0x427f
cmpb $0x0, 0x8(%rsp)
je 0x4000
leaq 0x31be(%rip), %rdi      # 0x71b2
movl %r12d, %esi
movl %ebp, %edx
xorl %eax, %eax
callq 0x2050
movq %rbp, 0xa0(%rsp)
movq %r12, 0x30(%rsp)
movl %r13d, 0xc(%rsp)
leaq 0x543a(%rip), %rdi      # 0x9453
callq 0x2220
cmpw $0x3, 0x4e(%rsp)
jne 0x4301
movq 0x48(%rsp), %rbx
movq %rbx, %rax
shrq $0x30, %rax
cmpl $0x3, %eax
jne 0x424b
movabsq $0xffffffffffff, %rax   # imm = 0xFFFFFFFFFFFF
andq %rax, %rbx
leaq 0x303e(%rip), %r13      # 0x7091
leaq 0x20(%rsp), %rbp
movq $0x0, 0x38(%rsp)
movq 0x48(%rsp), %rax
movabsq $0xffffffffffff, %rcx   # imm = 0xFFFFFFFFFFFF
andq %rcx, %rax
movl 0x40(%rsp), %ecx
shlq $0x5, %rcx
addq %rax, %rcx
cmpq %rcx, %rbx
je 0x426a
leaq 0x10(%rbx), %r12
movq %rbp, %rdi
movq %r12, %rsi
movq %r13, %rdx
callq 0x4ae8
movq 0x20(%rsp), %r14
movq %r12, %rdi
callq 0x4aa8
cmpq %rax, %r14
je 0x423b
movq %rbp, %rdi
movq %r12, %rsi
leaq 0x2fda(%rip), %rdx      # 0x7096
callq 0x4ae8
movq 0x20(%rsp), %r14
movq %r12, %rdi
callq 0x4aa8
cmpq %rax, %r14
je 0x423b
movq %rbp, %rdi
movq %r12, %rsi
leaq 0x3b74(%rip), %rdx      # 0x7c58
callq 0x4ae8
movq 0x20(%rsp), %r14
movq %r12, %rdi
callq 0x4aa8
cmpq %rax, %r14
je 0x423b
cmpl $0x3, 0xc(%rsp)
jne 0x412d
movq %r12, %rdi
leaq 0x3b48(%rip), %rsi      # 0x7c58
callq 0x4d34
testb $0x40, 0xe(%rax)
je 0x42be
movq 0x10(%rsp), %rcx
cmpl %ecx, (%rax)
je 0x4183
jmp 0x423b
cmpb $0x0, 0x8(%rsp)
je 0x4183
movq %r12, %rdi
leaq 0x3b1a(%rip), %rsi      # 0x7c58
callq 0x4d34
testb $0x40, 0xe(%rax)
je 0x42be
movq 0x30(%rsp), %rcx
cmpl %ecx, (%rax)
jb 0x423b
movq %r12, %rdi
leaq 0x3af4(%rip), %rsi      # 0x7c58
callq 0x4d34
testb $0x40, 0xe(%rax)
je 0x42be
movq 0xa0(%rsp), %rcx
cmpl %ecx, (%rax)
ja 0x423b
movq %r12, %rdi
leaq 0x2f09(%rip), %rsi      # 0x7096
callq 0x4d34
movq %rax, %rdi
callq 0x474e
movq %rax, %r15
movq %r12, %rdi
movq %r13, %rsi
callq 0x4d34
movq %rax, %rdi
callq 0x474e
movq %rax, %r14
movq %r12, %rdi
leaq 0x3a9b(%rip), %rsi      # 0x7c58
callq 0x4d34
testb $0x40, 0xe(%rax)
je 0x42be
movl (%rax), %ecx
leaq 0x3013(%rip), %rdi      # 0x71e8
movq %r15, %rsi
movq %r14, %rdx
xorl %eax, %eax
callq 0x2050
movq %rbp, %rdi
movq %r12, %rsi
leaq 0x2ef6(%rip), %rdx      # 0x70e5
callq 0x4ae8
movq 0x20(%rsp), %r14
movq %r12, %rdi
callq 0x4aa8
cmpq %rax, %r14
je 0x422a
movq %r12, %rdi
leaq 0x2ed5(%rip), %rsi      # 0x70e5
callq 0x4d34
leaq 0x40(%rsp), %rdi
movq %r12, %rsi
movq %rax, %rdx
xorl %ecx, %ecx
xorl %r8d, %r8d
callq 0x3693
incq 0x38(%rsp)
leaq 0x521e(%rip), %rdi      # 0x9454
callq 0x2220
addq $0x20, %rbx
cmpw $0x3, 0x4e(%rsp)
je 0x4061
leaq 0x3305(%rip), %rdi      # 0x7557
leaq 0x3279(%rip), %rsi      # 0x74d2
leaq 0x5149(%rip), %rcx      # 0x93a9
movl $0x492, %edx            # imm = 0x492
callq 0x20e0
leaq 0x2f8b(%rip), %rdi      # 0x71fc
xorl %ebx, %ebx
movq 0x38(%rsp), %rsi
xorl %eax, %eax
callq 0x2050
leaq 0x40(%rsp), %rdi
callq 0x496a
leaq 0xb8(%rsp), %rax
movq -0x10(%rax), %rdi
cmpq %rax, %rdi
je 0x42aa
movq 0xb8(%rsp), %rsi
incq %rsi
callq 0x2140
movl %ebx, %eax
addq $0xc8, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
popq %rbp
retq
leaq 0x3998(%rip), %rdi      # 0x7c5d
leaq 0x3206(%rip), %rsi      # 0x74d2
leaq 0x39a4(%rip), %rcx      # 0x7c77
movl $0x6ca, %edx            # imm = 0x6CA
callq 0x20e0
leaq 0x2f2c(%rip), %rdi      # 0x7210
callq 0x20d0
leaq 0x2f20(%rip), %rdi      # 0x7210
callq 0x20d0
leaq 0x2f14(%rip), %rdi      # 0x7210
callq 0x20d0
leaq 0x324f(%rip), %rdi      # 0x7557
leaq 0x31c3(%rip), %rsi      # 0x74d2
leaq 0x4ffd(%rip), %rcx      # 0x9313
movl $0x48f, %edx            # imm = 0x48F
callq 0x20e0
jmp 0x4342
jmp 0x4342
movq %rax, %r15
cmpl $0x0, (%r14)
jne 0x4330
movl %ebx, (%r14)
movq 0x40(%rsp), %rdi
cmpq %r13, %rdi
jne 0x4361
jmp 0x437d
jmp 0x4347
jmp 0x4342
jmp 0x4370
movq %rax, %r15
jmp 0x437d
movq %rax, %r15
cmpl $0x0, (%r14)
jne 0x4353
movl %ebp, (%r14)
leaq 0x50(%rsp), %rax
movq -0x10(%rax), %rdi
cmpq %rax, %rdi
je 0x437d
movq 0x50(%rsp), %rsi
incq %rsi
callq 0x2140
jmp 0x437d
movq %rax, %r15
leaq 0x40(%rsp), %rdi
callq 0x496a
leaq 0xb8(%rsp), %rax
movq -0x10(%rax), %rdi
cmpq %rax, %rdi
je 0x439e
movq 0xb8(%rsp), %rsi
incq %rsi
callq 0x2140
movq %r15, %rdi
callq 0x2250