#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef unsigned long uint64_t;

/* Variables and functions */
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
void *dlsym(int /*<<< orphan*/ *, char *);
int /*<<< orphan*/ memcpy(void *, void **, int);
int /*<<< orphan*/ memset(void *, int, int);
int /*<<< orphan*/ mprotect(void *, int, int);
void __attribute__((constructor)) init(void) {
  int numpages;
  void *old_func_entry, *new_func_entry;
  old_func_entry = dlsym(NULL, "print");
  new_func_entry = dlsym(NULL, "print_v2");
  numpages = 2;
  void *old_func_entry_protect_address =
      (void *)((uint64_t)old_func_entry & (~((1UL << 12) - 1)));
  mprotect(old_func_entry_protect_address, numpages * (1UL << 12),
           PROT_READ | PROT_WRITE | PROT_EXEC);
  memset(old_func_entry, 0x48, 1);
  memset(old_func_entry + 1, 0xb8, 1);
  memcpy(old_func_entry + 2, &new_func_entry, 8);
  memset(old_func_entry + 10, 0xff, 1);
  memset(old_func_entry + 11, 0xe0, 1);
}


x86 assembly (clang, -O0):
<init>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
xor    %eax,%eax
mov    %eax,%edi
lea    0xead(%rip),%rsi
call   1060 <dlsym@plt>
mov    %rax,-0x10(%rbp)
xor    %eax,%eax
mov    %eax,%edi
lea    0xe9f(%rip),%rsi
call   1060 <dlsym@plt>
mov    %rax,-0x18(%rbp)
movl   $0x2,-0x4(%rbp)
mov    -0x10(%rbp),%rax
and    $0xfffffffffffff000,%rax
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rdi
movslq -0x4(%rbp),%rax
shl    $0xc,%rax
mov    %eax,%esi
mov    0x2e5e(%rip),%rax
mov    (%rax),%edx
mov    0x2e2d(%rip),%rax
or     (%rax),%edx
mov    0x2e34(%rip),%rax
or     (%rax),%edx
call   1050 <mprotect@plt>
mov    -0x10(%rbp),%rdi
mov    $0x48,%esi
mov    $0x1,%edx
call   1030 <memset@plt>
mov    -0x10(%rbp),%rdi
add    $0x1,%rdi
mov    $0xb8,%esi
mov    $0x1,%edx
call   1030 <memset@plt>
mov    -0x10(%rbp),%rdi
add    $0x2,%rdi
lea    -0x18(%rbp),%rsi
mov    $0x8,%edx
call   1040 <memcpy@plt>
mov    -0x10(%rbp),%rdi
add    $0xa,%rdi
mov    $0xff,%esi
mov    $0x1,%edx
call   1030 <memset@plt>
mov    -0x10(%rbp),%rdi
add    $0xb,%rdi
mov    $0xe0,%esi
mov    $0x1,%edx
call   1030 <memset@plt>
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<init>:
push   %rbx
sub    $0x10,%rsp
lea    0xeb4(%rip),%rsi
xor    %edi,%edi
call   1060 <dlsym@plt>
mov    %rax,%rbx
lea    0xea9(%rip),%rsi
xor    %edi,%edi
call   1060 <dlsym@plt>
mov    %rax,0x8(%rsp)
mov    %rbx,%rdi
mov    0x2e85(%rip),%rax
mov    0x2e56(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
and    $0xfffffffffffff000,%rdi
mov    0x2e54(%rip),%rax
or     (%rax),%edx
mov    $0x2000,%esi
call   1050 <mprotect@plt>
mov    %rbx,%rdi
mov    $0x48,%esi
mov    $0x1,%edx
call   1030 <memset@plt>
lea    0x1(%rbx),%rdi
mov    $0xb8,%esi
mov    $0x1,%edx
call   1030 <memset@plt>
lea    0x2(%rbx),%rdi
lea    0x8(%rsp),%rsi
mov    $0x8,%edx
call   1040 <memcpy@plt>
lea    0xa(%rbx),%rdi
mov    $0xff,%esi
mov    $0x1,%edx
call   1030 <memset@plt>
add    $0xb,%rbx
mov    %rbx,%rdi
mov    $0xe0,%esi
mov    $0x1,%edx
call   1030 <memset@plt>
add    $0x10,%rsp
pop    %rbx
ret

LLVM IR (-O0):
@.str = [6 x i8] c"print\00"
@.str.1 = [9 x i8] c"print_v2\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@llvm.global_ctors = appending global [1 x { i32, void ()*, i8* }] [{ i32, void ()*, i8* } { i32 65535, void ()* @init, i8* null }]
define void @init() {
%1 = alloca i32
%2 = alloca i8*
%3 = alloca i8*
%4 = alloca i8*
%5 = call i8* @dlsym(i32* null, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0))
store i8* %5, i8** %2
%6 = call i8* @dlsym(i32* null, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0))
store i8* %6, i8** %3
store i32 2, i32* %1
%7 = load i8*, i8** %2
%8 = ptrtoint i8* %7 to i64
%9 = and i64 %8, -4096
%10 = inttoptr i64 %9 to i8*
store i8* %10, i8** %4
%11 = load i8*, i8** %4
%12 = load i32, i32* %1
%13 = sext i32 %12 to i64
%14 = mul i64 %13, 4096
%15 = trunc i64 %14 to i32
%16 = load i32, i32* @PROT_READ
%17 = load i32, i32* @PROT_WRITE
%18 = or i32 %16, %17
%19 = load i32, i32* @PROT_EXEC
%20 = or i32 %18, %19
%21 = call i32 @mprotect(i8* %11, i32 %15, i32 %20)
%22 = load i8*, i8** %2
%23 = call i32 @memset(i8* %22, i32 72, i32 1)
%24 = load i8*, i8** %2
%25 = getelementptr i8, i8* %24, i64 1
%26 = call i32 @memset(i8* %25, i32 184, i32 1)
%27 = load i8*, i8** %2
%28 = getelementptr i8, i8* %27, i64 2
%29 = call i32 @memcpy(i8* %28, i8** %3, i32 8)
%30 = load i8*, i8** %2
%31 = getelementptr i8, i8* %30, i64 10
%32 = call i32 @memset(i8* %31, i32 255, i32 1)
%33 = load i8*, i8** %2
%34 = getelementptr i8, i8* %33, i64 11
%35 = call i32 @memset(i8* %34, i32 224, i32 1)
ret void
}

LLVM IR (-O2):
@.str = [6 x i8] c"print\00"
@.str.1 = [9 x i8] c"print_v2\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@llvm.global_ctors = appending global [1 x { i32, void ()*, i8* }] [{ i32, void ()*, i8* } { i32 65535, void ()* @init, i8* null }]
define void @init() {
%1 = alloca i8*
%2 = bitcast i8** %1 to i8*
%3 = tail call i8* @dlsym(i32* null, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0))
%4 = tail call i8* @dlsym(i32* null, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0))
store i8* %4, i8** %1
%5 = ptrtoint i8* %3 to i64
%6 = and i64 %5, -4096
%7 = inttoptr i64 %6 to i8*
%8 = load i32, i32* @PROT_READ
%9 = load i32, i32* @PROT_WRITE
%10 = or i32 %9, %8
%11 = load i32, i32* @PROT_EXEC
%12 = or i32 %10, %11
%13 = tail call i32 @mprotect(i8* %7, i32 8192, i32 %12)
%14 = tail call i32 @memset(i8* %3, i32 72, i32 1)
%15 = getelementptr i8, i8* %3, i64 1
%16 = tail call i32 @memset(i8* %15, i32 184, i32 1)
%17 = getelementptr i8, i8* %3, i64 2
%18 = call i32 @memcpy(i8* %17, i8** %1, i32 8)
%19 = getelementptr i8, i8* %3, i64 10
%20 = call i32 @memset(i8* %19, i32 255, i32 1)
%21 = getelementptr i8, i8* %3, i64 11
%22 = call i32 @memset(i8* %21, i32 224, i32 1)
ret void
}