#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ szBuf;
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char *, char *);
int fread(char *, int, int, int /*<<< orphan*/ *);
scalar_t__ malloc(int);
int /*<<< orphan*/ memcpy(char *, char *, int);
int /*<<< orphan*/ memset(char *, int /*<<< orphan*/, int);
int /*<<< orphan*/ mprotect(char *, int, int);
int /*<<< orphan*/ printf(char *, int);
int vfunc(char *fn) {
  void (*fun)();
  char *shellcode;
  char szBuf[4096] = {
      0x00,
  };
  char *p = szBuf;
  int f, rv, cnt;
  FILE *fp;
  shellcode = (char *)malloc(4096);
  mprotect(shellcode, 4096, PROT_READ | PROT_WRITE | PROT_EXEC);
  memset(shellcode, 0, 4096);
  memset(szBuf, 0, sizeof(szBuf));
  fp = fopen(fn, "r");
  cnt = 0;
  while (1) {
    rv = fread(p, 1, 1, fp);
    p++;
    if (!rv)
      break;
    cnt++;
  }
  szBuf[cnt] = '\0';
  fclose(fp);
  printf("cnt: %d\n", cnt);
  memcpy(shellcode, szBuf, cnt);
  fun = (void (*)())shellcode;
  fun();
  return 0;
}


x86 assembly (clang, -O0):
<vfunc>:
push   %rbp
mov    %rsp,%rbp
sub    $0x1040,%rsp
mov    %rdi,-0x8(%rbp)
lea    -0x1020(%rbp),%rdi
xor    %esi,%esi
mov    $0x1000,%edx
call   1060 <memset@plt>
lea    -0x1020(%rbp),%rax
mov    %rax,-0x1028(%rbp)
mov    $0x1000,%edi
call   1080 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rdi
mov    0x2e2f(%rip),%rax
mov    (%rax),%edx
mov    0x2dfe(%rip),%rax
or     (%rax),%edx
mov    0x2e05(%rip),%rax
or     (%rax),%edx
mov    $0x1000,%esi
call   1090 <mprotect@plt>
mov    -0x18(%rbp),%rdi
xor    %esi,%esi
mov    $0x1000,%edx
call   1060 <memset@plt>
lea    -0x1020(%rbp),%rdi
xor    %esi,%esi
mov    $0x1000,%edx
call   1060 <memset@plt>
mov    -0x8(%rbp),%rdi
lea    0xdeb(%rip),%rsi
call   10a0 <fopen@plt>
mov    %rax,-0x1040(%rbp)
movl   $0x0,-0x1034(%rbp)
mov    -0x1028(%rbp),%rdi
mov    -0x1040(%rbp),%rcx
mov    $0x1,%edx
mov    %edx,%esi
call   1030 <fread@plt>
mov    %eax,-0x1030(%rbp)
mov    -0x1028(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x1028(%rbp)
cmpl   $0x0,-0x1030(%rbp)
jne    126f <vfunc+0xef>
jmp    1283 <vfunc+0x103>
mov    -0x1034(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1034(%rbp)
jmp    122b <vfunc+0xab>
movslq -0x1034(%rbp),%rax
movb   $0x0,-0x1020(%rbp,%rax,1)
mov    -0x1040(%rbp),%rdi
call   1040 <fclose@plt>
mov    -0x1034(%rbp),%esi
lea    0xd57(%rip),%rdi
call   1050 <printf@plt>
mov    -0x18(%rbp),%rdi
lea    -0x1020(%rbp),%rsi
mov    -0x1034(%rbp),%edx
call   1070 <memcpy@plt>
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    $0x0,%al
call   *-0x10(%rbp)
xor    %eax,%eax
add    $0x1040,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<vfunc>:
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x1008,%rsp
mov    %rdi,%r12
mov    %rsp,%r15
xor    %ebx,%ebx
mov    $0x1000,%edx
mov    %r15,%rdi
xor    %esi,%esi
call   1060 <memset@plt>
mov    $0x1000,%edi
call   1080 <malloc@plt>
mov    0x2e42(%rip),%rcx
mov    0x2e13(%rip),%rdx
mov    (%rdx),%edx
or     (%rcx),%edx
mov    %rax,%r14
mov    0x2e15(%rip),%rax
or     (%rax),%edx
mov    %r14,%rdi
mov    $0x1000,%esi
call   1090 <mprotect@plt>
mov    %r14,%rdi
xor    %esi,%esi
mov    $0x1000,%edx
call   1060 <memset@plt>
mov    %r15,%rdi
xor    %esi,%esi
mov    $0x1000,%edx
call   1060 <memset@plt>
lea    0xe01(%rip),%rsi
mov    %r12,%rdi
call   10a0 <fopen@plt>
mov    %rax,%r12
mov    %r15,%rdi
mov    $0x1,%esi
mov    $0x1,%edx
mov    %rax,%rcx
call   1030 <fread@plt>
test   %eax,%eax
je     124e <vfunc+0xce>
lea    0x1(%rsp),%r15
xor    %ebx,%ebx
nopw   0x0(%rax,%rax,1)
lea    (%r15,%rbx,1),%rdi
mov    $0x1,%esi
mov    $0x1,%edx
mov    %r12,%rcx
call   1030 <fread@plt>
add    $0x1,%rbx
test   %eax,%eax
jne    1230 <vfunc+0xb0>
mov    %ebx,%eax
movb   $0x0,(%rsp,%rax,1)
mov    %r12,%rdi
call   1040 <fclose@plt>
lea    0xd9f(%rip),%rdi
mov    %ebx,%esi
call   1050 <printf@plt>
mov    %rsp,%rsi
mov    %r14,%rdi
mov    %ebx,%edx
call   1070 <memcpy@plt>
xor    %eax,%eax
call   *%r14
xor    %eax,%eax
add    $0x1008,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@.str = [2 x i8] c"r\00"
@.str.1 = [9 x i8] c"cnt: %d\0A\00"
define i32 @vfunc(i8* %0) {
%2 = alloca i8*
%3 = alloca void (...)*
%4 = alloca i8*
%5 = alloca [4096 x i8]
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32*
store i8* %0, i8** %2
%11 = bitcast [4096 x i8]* %5 to i8*
%12 = getelementptr inbounds [4096 x i8], [4096 x i8]* %5, i64 0, i64 0
store i8* %12, i8** %6
%13 = call i64 @malloc(i32 4096)
%14 = inttoptr i64 %13 to i8*
store i8* %14, i8** %4
%15 = load i8*, i8** %4
%16 = load i32, i32* @PROT_READ
%17 = load i32, i32* @PROT_WRITE
%18 = or i32 %16, %17
%19 = load i32, i32* @PROT_EXEC
%20 = or i32 %18, %19
%21 = call i32 @mprotect(i8* %15, i32 4096, i32 %20)
%22 = load i8*, i8** %4
%23 = call i32 @memset(i8* %22, i32 0, i32 4096)
%24 = getelementptr inbounds [4096 x i8], [4096 x i8]* %5, i64 0, i64 0
%25 = call i32 @memset(i8* %24, i32 0, i32 4096)
%26 = load i8*, i8** %2
%27 = call i32* @fopen(i8* %26, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
store i32* %27, i32** %10
store i32 0, i32* %9
br label %28
28: ; preds = %1, %37
%29 = load i8*, i8** %6
%30 = load i32*, i32** %10
%31 = call i32 @fread(i8* %29, i32 1, i32 1, i32* %30)
store i32 %31, i32* %8
%32 = load i8*, i8** %6
%33 = getelementptr inbounds i8, i8* %32, i32 1
store i8* %33, i8** %6
%34 = load i32, i32* %8
%35 = icmp ne i32 %34, 0
br i1 %35, label %37, label %36
36: ; preds = %28
br label %40
37: ; preds = %28
%38 = load i32, i32* %9
%39 = add nsw i32 %38, 1
store i32 %39, i32* %9
br label %28
40: ; preds = %36
%41 = load i32, i32* %9
%42 = sext i32 %41 to i64
%43 = getelementptr inbounds [4096 x i8], [4096 x i8]* %5, i64 0, i64 %42
store i8 0, i8* %43
%44 = load i32*, i32** %10
%45 = call i32 @fclose(i32* %44)
%46 = load i32, i32* %9
%47 = call i32 @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i32 %46)
%48 = load i8*, i8** %4
%49 = getelementptr inbounds [4096 x i8], [4096 x i8]* %5, i64 0, i64 0
%50 = load i32, i32* %9
%51 = call i32 @memcpy(i8* %48, i8* %49, i32 %50)
%52 = load i8*, i8** %4
%53 = bitcast i8* %52 to void (...)*
store void (...)* %53, void (...)** %3
%54 = load void (...)*, void (...)** %3
ret i32 0
}

LLVM IR (-O2):
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@.str = [2 x i8] c"r\00"
@.str.1 = [9 x i8] c"cnt: %d\0A\00"
define i32 @vfunc(i8* nocapture %0) {
%2 = alloca [4096 x i8]
%3 = getelementptr inbounds [4096 x i8], [4096 x i8]* %2, i64 0, i64 0
%4 = tail call i64 @malloc(i32 4096)
%5 = inttoptr i64 %4 to i8*
%6 = load i32, i32* @PROT_READ
%7 = load i32, i32* @PROT_WRITE
%8 = or i32 %7, %6
%9 = load i32, i32* @PROT_EXEC
%10 = or i32 %8, %9
%11 = tail call i32 @mprotect(i8* %5, i32 4096, i32 %10)
%12 = tail call i32 @memset(i8* %5, i32 0, i32 4096)
%13 = call i32 @memset(i8* %3, i32 0, i32 4096)
%14 = call i32* @fopen(i8* %0, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%15 = call i32 @fread(i8* %3, i32 1, i32 1, i32* %14)
%16 = icmp eq i32 %15, 0
br i1 %16, label %24, label %17
17: ; preds = %1, %17
%18 = phi i8* [ %20, %17 ], [ %3, %1 ]
%19 = phi i32 [ %21, %17 ], [ 0, %1 ]
%20 = getelementptr inbounds i8, i8* %18, i64 1
%21 = add nuw nsw i32 %19, 1
%22 = call i32 @fread(i8* %20, i32 1, i32 1, i32* %14)
%23 = icmp eq i32 %22, 0
br i1 %23, label %24, label %17
24: ; preds = %17, %1
%25 = phi i32 [ 0, %1 ], [ %21, %17 ]
%26 = zext i32 %25 to i64
%27 = getelementptr inbounds [4096 x i8], [4096 x i8]* %2, i64 0, i64 %26
store i8 0, i8* %27
%28 = call i32 @fclose(i32* %14)
%29 = call i32 @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i32 %25)
%30 = call i32 @memcpy(i8* %5, i8* %3, i32 %25)
%31 = inttoptr i64 %4 to void (...)*
ret i32 0
}