#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int rand();
unsigned long long get_kernel_address(void) {
  unsigned long long val;
  switch (rand() % 6) {
  case 0:
    val = ((long long)rand() << 32) | rand();
    break;
  case 1:
  case 2:
  case 3:
    val = 0xffffffff00000000ULL | rand();
    break;
  case 4:
    val = 0xc0000000ULL | rand();
  default:
    val = 0;
  }
  return val;
}


x86 assembly (clang, -O0):
<get_kernel_address>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
xor    %eax,%eax
call   1030 <rand@plt>
movslq %eax,%rcx
imul   $0x2aaaaaab,%rcx,%rdx
mov    %rdx,%rcx
shr    $0x3f,%rcx
shr    $0x20,%rdx
add    %ecx,%edx
add    %edx,%edx
mov    %edx,%ecx
lea    (%rcx,%rcx,2),%ecx
sub    %ecx,%eax
mov    %eax,-0xc(%rbp)
je     1172 <get_kernel_address+0x62>
jmp    114d <get_kernel_address+0x3d>
mov    -0xc(%rbp),%eax
add    $0xffffffff,%eax
sub    $0x3,%eax
jb     119f <get_kernel_address+0x8f>
jmp    1161 <get_kernel_address+0x51>
mov    -0xc(%rbp),%eax
sub    $0x4,%eax
je     11be <get_kernel_address+0xae>
jmp    11d8 <get_kernel_address+0xc8>
mov    $0x0,%al
call   1030 <rand@plt>
cltq
shl    $0x20,%rax
mov    %rax,-0x18(%rbp)
mov    $0x0,%al
call   1030 <rand@plt>
mov    %eax,%ecx
mov    -0x18(%rbp),%rax
movslq %ecx,%rcx
or     %rcx,%rax
mov    %rax,-0x8(%rbp)
jmp    11e0 <get_kernel_address+0xd0>
mov    $0x0,%al
call   1030 <rand@plt>
cltq
movabs $0xffffffff00000000,%rcx
ff ff ff
or     %rcx,%rax
mov    %rax,-0x8(%rbp)
jmp    11e0 <get_kernel_address+0xd0>
mov    $0x0,%al
call   1030 <rand@plt>
cltq
movabs $0xc0000000,%rcx
or     %rcx,%rax
mov    %rax,-0x8(%rbp)
movq   $0x0,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<get_kernel_address>:
push   %r14
push   %rbx
push   %rax
xor    %ebx,%ebx
xor    %eax,%eax
call   1030 <rand@plt>
movslq %eax,%rcx
imul   $0x2aaaaaab,%rcx,%rcx
mov    %rcx,%rdx
shr    $0x3f,%rdx
shr    $0x20,%rcx
add    %edx,%ecx
add    %ecx,%ecx
lea    (%rcx,%rcx,2),%ecx
mov    %ecx,%edx
neg    %edx
add    %eax,%edx
add    $0xffffffff,%edx
cmp    $0x3,%edx
jae    115d <get_kernel_address+0x4d>
xor    %eax,%eax
call   1030 <rand@plt>
movabs $0xffffffff00000000,%rbx
ff ff ff
or     %rax,%rbx
jmp    118e <get_kernel_address+0x7e>
sub    %ecx,%eax
cmp    $0x4,%eax
je     1185 <get_kernel_address+0x75>
test   %eax,%eax
jne    118e <get_kernel_address+0x7e>
xor    %eax,%eax
call   1030 <rand@plt>
mov    %eax,%r14d
shl    $0x20,%r14
xor    %eax,%eax
call   1030 <rand@plt>
movslq %eax,%rbx
or     %r14,%rbx
jmp    118e <get_kernel_address+0x7e>
xor    %ebx,%ebx
xor    %eax,%eax
call   1030 <rand@plt>
mov    %rbx,%rax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
define i64 @get_kernel_address() {
%1 = alloca i64
%2 = call i32 (...) @rand()
%3 = srem i32 %2, 6
switch i32 %3, label %19 [
i32 0, label %4
i32 1, label %11
i32 2, label %11
i32 3, label %11
i32 4, label %15
]
4: ; preds = %0
%5 = call i32 (...) @rand()
%6 = sext i32 %5 to i64
%7 = shl i64 %6, 32
%8 = call i32 (...) @rand()
%9 = sext i32 %8 to i64
%10 = or i64 %7, %9
store i64 %10, i64* %1
br label %20
11: ; preds = %0, %0, %0
%12 = call i32 (...) @rand()
%13 = sext i32 %12 to i64
%14 = or i64 -4294967296, %13
store i64 %14, i64* %1
br label %20
15: ; preds = %0
%16 = call i32 (...) @rand()
%17 = sext i32 %16 to i64
%18 = or i64 3221225472, %17
store i64 %18, i64* %1
br label %19
19: ; preds = %0, %15
store i64 0, i64* %1
br label %20
20: ; preds = %19, %11, %4
%21 = load i64, i64* %1
ret i64 %21
}

LLVM IR (-O2):
define i64 @get_kernel_address() {
%1 = tail call i32 (...) @rand()
%2 = srem i32 %1, 6
switch i32 %2, label %16 [
i32 0, label %3
i32 1, label %10
i32 2, label %10
i32 3, label %10
i32 4, label %14
]
3: ; preds = %0
%4 = tail call i32 (...) @rand()
%5 = zext i32 %4 to i64
%6 = shl nuw i64 %5, 32
%7 = tail call i32 (...) @rand()
%8 = sext i32 %7 to i64
%9 = or i64 %6, %8
br label %16
10: ; preds = %0, %0, %0
%11 = tail call i32 (...) @rand()
%12 = zext i32 %11 to i64
%13 = or i64 %12, -4294967296
br label %16
14: ; preds = %0
%15 = tail call i32 (...) @rand()
br label %16
16: ; preds = %14, %0, %10, %3
%17 = phi i64 [ %13, %10 ], [ %9, %3 ], [ 0, %0 ], [ 0, %14 ]
ret i64 %17
}