// File: /workspace/github_c_makefile_star2_O0/adsr[P]phpspy/addr_objdump.c
// Function: get_php_base_addr
static int get_php_base_addr(pid_t pid, char *path_root, char *path, uint64_t *raddr) {
    /**
     * This is very likely to be incorrect/incomplete. I thought the base
     * address from `/proc/<pid>/maps` + the symbol address from `readelf` would
     * lead to the actual memory address, but on at least one system I tested on
     * this is not the case. On that system, working backwards from the address
     * printed in `gdb`, it seems the missing piece was the 'virtual address' of
     * the LOAD section in ELF headers. I suspect this may have to do with
     * address relocation and/or a feature called 'prelinking', but not sure.
     */
    char buf[PHPSPY_STR_SIZE];
    char arg_buf[PHPSPY_STR_SIZE];
    uint64_t start_addr;
    uint64_t virt_addr;
    char *cmd_fmt = "grep -m1 ' '%s\\$ /proc/%d/maps";
    if (shell_escape(path, arg_buf, sizeof(arg_buf), "path")) {
        return 1;
    }
    if (popen_read_line(buf, sizeof(buf), cmd_fmt, arg_buf, (int)pid) != 0) {
        log_error("get_php_base_addr: Failed to get start_addr\n");
        return 1;
    }
    start_addr = strtoull(buf, NULL, 16);
    if (shell_escape(path_root, arg_buf, sizeof(arg_buf), "path_root")) {
        return 1;
    }
    cmd_fmt = "objdump -p %s | awk '/LOAD/{print $5; exit}'";
    if (popen_read_line(buf, sizeof(buf), cmd_fmt, arg_buf) != 0) {
        log_error("get_php_base_addr: Failed to get virt_addr\n");
        return 1;
    }
    virt_addr = strtoull(buf, NULL, 16);
    *raddr = start_addr - virt_addr;
    return 0;
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x240, %rsp            # imm = 0x240
movl %edi, -0x8(%rbp)
movq %rsi, -0x10(%rbp)
movq %rdx, -0x18(%rbp)
movq %rcx, -0x20(%rbp)
leaq 0x89b4(%rip), %rax      # 0x35385
movq %rax, -0x238(%rbp)
movq -0x18(%rbp), %rdi
leaq -0x220(%rbp), %rsi
movl $0x100, %edx            # imm = 0x100
leaq 0x89b5(%rip), %rcx      # 0x353a4
callq 0x2c610
cmpl $0x0, %eax
je 0x2ca05
movl $0x1, -0x4(%rbp)
jmp 0x2cb15
leaq -0x120(%rbp), %rdi
movq -0x238(%rbp), %rdx
leaq -0x220(%rbp), %rcx
movl -0x8(%rbp), %r8d
movl $0x100, %esi            # imm = 0x100
movb $0x0, %al
callq 0x2cc00
cmpl $0x0, %eax
je 0x2ca49
leaq 0x8973(%rip), %rdi      # 0x353a9
movb $0x0, %al
callq 0x9cc0
movl $0x1, -0x4(%rbp)
jmp 0x2cb15
leaq -0x120(%rbp), %rdi
xorl %eax, %eax
movl %eax, %esi
movl $0x10, %edx
callq 0x62e0
movq %rax, -0x228(%rbp)
movq -0x10(%rbp), %rdi
leaq -0x220(%rbp), %rsi
movl $0x100, %edx            # imm = 0x100
leaq 0x895a(%rip), %rcx      # 0x353d6
callq 0x2c610
cmpl $0x0, %eax
je 0x2ca92
movl $0x1, -0x4(%rbp)
jmp 0x2cb15
leaq 0x8947(%rip), %rax      # 0x353e0
movq %rax, -0x238(%rbp)
leaq -0x120(%rbp), %rdi
movq -0x238(%rbp), %rdx
leaq -0x220(%rbp), %rcx
movl $0x100, %esi            # imm = 0x100
movb $0x0, %al
callq 0x2cc00
cmpl $0x0, %eax
je 0x2cadd
leaq 0x8940(%rip), %rdi      # 0x3540d
movb $0x0, %al
callq 0x9cc0
movl $0x1, -0x4(%rbp)
jmp 0x2cb15
leaq -0x120(%rbp), %rdi
xorl %eax, %eax
movl %eax, %esi
movl $0x10, %edx
callq 0x62e0
movq %rax, -0x230(%rbp)
movq -0x228(%rbp), %rcx
subq -0x230(%rbp), %rcx
movq -0x20(%rbp), %rax
movq %rcx, (%rax)
movl $0x0, -0x4(%rbp)
movl -0x4(%rbp), %eax
addq $0x240, %rsp            # imm = 0x240
popq %rbp
retq
nopw %cs:(%rax,%rax)