#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int uint64_t;

/* Variables and functions */
int MAP_ANONYMOUS;
int MAP_PRIVATE;
int PROT_READ;
int PROT_WRITE;
int get_address(char *);
scalar_t__ geteuid();
int /*<<< orphan*/ kAFL_hypercall(int, int);
int /*<<< orphan*/ load_programm(void *);
int /*<<< orphan*/ memset(void *, int, int);
void *mmap(void *, int, int, int, int, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, ...);
int main(int argc, char **argv) {
  uint64_t panic_handler = 0x0;
  uint64_t kasan_handler = 0x0;
  void *program_buffer;
  if (geteuid()) {
    printf("<< kAFL Usermode Load for Linux x86-64 >>\n");
    printf("Loader requires root privileges...\n");
    return 1;
  }
  panic_handler = get_address("T panic\n");
  printf("Kernel Panic Handler Address:\t%lx\n", panic_handler);
  kasan_handler = get_address("t kasan_report_error\n");
  if (kasan_handler) {
    printf("Kernel KASAN Handler Address:\t%lx\n", kasan_handler);
  }
  program_buffer = mmap((void *)0xabcd0000, (16 << 20), PROT_READ | PROT_WRITE,
                        MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  memset(program_buffer, 0xff, (16 << 20));
  kAFL_hypercall(10, 0);
  kAFL_hypercall(0, 0);
  kAFL_hypercall(4, 0);
  kAFL_hypercall(6, panic_handler);
  if (kasan_handler) {
    kAFL_hypercall(7, kasan_handler);
  }
  kAFL_hypercall(2, (uint64_t)program_buffer);
  load_programm(program_buffer);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x0,-0x14(%rbp)
movl   $0x0,-0x18(%rbp)
mov    $0x0,%al
call   1080 <geteuid@plt>
cmp    $0x0,%rax
je     11cd <main+0x5d>
lea    0xe54(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xe71(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    12cf <main+0x15f>
lea    0xe7b(%rip),%rdi
call   1030 <get_address@plt>
mov    %eax,-0x14(%rbp)
mov    -0x14(%rbp),%esi
lea    0xe72(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xe87(%rip),%rdi
call   1030 <get_address@plt>
mov    %eax,-0x18(%rbp)
cmpl   $0x0,-0x18(%rbp)
je     1217 <main+0xa7>
mov    -0x18(%rbp),%esi
lea    0xe81(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    0x2dda(%rip),%rax
mov    (%rax),%edx
mov    0x2da9(%rip),%rax
or     (%rax),%edx
mov    0x2d98(%rip),%rax
mov    (%rax),%ecx
mov    0x2da7(%rip),%rax
or     (%rax),%ecx
mov    $0xabcd0000,%edi
mov    $0x1000000,%esi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1050 <mmap@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rdi
mov    $0xff,%esi
mov    $0x1000000,%edx
call   1070 <memset@plt>
mov    $0xa,%edi
xor    %esi,%esi
call   1090 <kAFL_hypercall@plt>
xor    %esi,%esi
mov    %esi,%edi
call   1090 <kAFL_hypercall@plt>
mov    $0x4,%edi
xor    %esi,%esi
call   1090 <kAFL_hypercall@plt>
mov    -0x14(%rbp),%esi
mov    $0x6,%edi
call   1090 <kAFL_hypercall@plt>
cmpl   $0x0,-0x18(%rbp)
je     12af <main+0x13f>
mov    -0x18(%rbp),%esi
mov    $0x7,%edi
call   1090 <kAFL_hypercall@plt>
mov    -0x20(%rbp),%rax
mov    %eax,%esi
mov    $0x2,%edi
call   1090 <kAFL_hypercall@plt>
mov    -0x20(%rbp),%rdi
call   1040 <load_programm@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
xor    %eax,%eax
call   1090 <geteuid@plt>
test   %rax,%rax
je     11b5 <main+0x35>
lea    0xecb(%rip),%rdi
call   1040 <puts@plt>
lea    0xee9(%rip),%rdi
call   1040 <puts@plt>
mov    $0x1,%ebx
jmp    129f <main+0x11f>
lea    0xe44(%rip),%rdi
call   1030 <get_address@plt>
mov    %eax,%r14d
lea    0xe3e(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1070 <printf@plt>
lea    0xe51(%rip),%rdi
call   1030 <get_address@plt>
mov    %eax,%r15d
test   %eax,%eax
je     11f8 <main+0x78>
lea    0xe54(%rip),%rdi
mov    %r15d,%esi
xor    %eax,%eax
call   1070 <printf@plt>
mov    0x2df9(%rip),%rax
mov    0x2dca(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
mov    0x2db7(%rip),%rax
mov    0x2dc8(%rip),%rcx
mov    (%rcx),%ecx
or     (%rax),%ecx
xor    %ebx,%ebx
mov    $0xabcd0000,%edi
mov    $0x1000000,%esi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1060 <mmap@plt>
mov    %rax,%rbp
mov    %rax,%rdi
mov    $0xff,%esi
mov    $0x1000000,%edx
call   1080 <memset@plt>
mov    $0xa,%edi
xor    %esi,%esi
call   10a0 <kAFL_hypercall@plt>
xor    %edi,%edi
xor    %esi,%esi
call   10a0 <kAFL_hypercall@plt>
mov    $0x4,%edi
xor    %esi,%esi
call   10a0 <kAFL_hypercall@plt>
mov    $0x6,%edi
mov    %r14d,%esi
call   10a0 <kAFL_hypercall@plt>
test   %r15d,%r15d
je     128b <main+0x10b>
mov    $0x7,%edi
mov    %r15d,%esi
call   10a0 <kAFL_hypercall@plt>
mov    $0x2,%edi
mov    %ebp,%esi
call   10a0 <kAFL_hypercall@plt>
mov    %rbp,%rdi
call   1050 <load_programm@plt>
mov    %ebx,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [43 x i8] c"<< kAFL Usermode Load for Linux x86-64 >>\0A\00"
@.str.1 = [36 x i8] c"Loader requires root privileges...\0A\00"
@.str.2 = [9 x i8] c"T panic\0A\00"
@.str.3 = [35 x i8] c"Kernel Panic Handler Address:\09%lx\0A\00"
@.str.4 = [22 x i8] c"t kasan_report_error\0A\00"
@.str.5 = [35 x i8] c"Kernel KASAN Handler Address:\09%lx\0A\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i8*
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 0, i32* %6
store i32 0, i32* %7
%9 = call i64 (...) @geteuid()
%10 = icmp ne i64 %9, 0
br i1 %10, label %11, label %14
11: ; preds = %2
%12 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([43 x i8], [43 x i8]* @.str, i64 0, i64 0))
%13 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.1, i64 0, i64 0))
store i32 1, i32* %3
br label %50
14: ; preds = %2
%15 = call i32 @get_address(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.2, i64 0, i64 0))
store i32 %15, i32* %6
%16 = load i32, i32* %6
%17 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.3, i64 0, i64 0), i32 %16)
%18 = call i32 @get_address(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.4, i64 0, i64 0))
store i32 %18, i32* %7
%19 = load i32, i32* %7
%20 = icmp ne i32 %19, 0
br i1 %20, label %21, label %24
21: ; preds = %14
%22 = load i32, i32* %7
%23 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.5, i64 0, i64 0), i32 %22)
br label %24
24: ; preds = %21, %14
%25 = load i32, i32* @PROT_READ
%26 = load i32, i32* @PROT_WRITE
%27 = or i32 %25, %26
%28 = load i32, i32* @MAP_PRIVATE
%29 = load i32, i32* @MAP_ANONYMOUS
%30 = or i32 %28, %29
%31 = call i8* @mmap(i8* inttoptr (i64 2882338816 to i8*), i32 16777216, i32 %27, i32 %30, i32 -1, i32 0)
store i8* %31, i8** %8
%32 = load i8*, i8** %8
%33 = call i32 @memset(i8* %32, i32 255, i32 16777216)
%34 = call i32 @kAFL_hypercall(i32 10, i32 0)
%35 = call i32 @kAFL_hypercall(i32 0, i32 0)
%36 = call i32 @kAFL_hypercall(i32 4, i32 0)
%37 = load i32, i32* %6
%38 = call i32 @kAFL_hypercall(i32 6, i32 %37)
%39 = load i32, i32* %7
%40 = icmp ne i32 %39, 0
br i1 %40, label %41, label %44
41: ; preds = %24
%42 = load i32, i32* %7
%43 = call i32 @kAFL_hypercall(i32 7, i32 %42)
br label %44
44: ; preds = %41, %24
%45 = load i8*, i8** %8
%46 = ptrtoint i8* %45 to i32
%47 = call i32 @kAFL_hypercall(i32 2, i32 %46)
%48 = load i8*, i8** %8
%49 = call i32 @load_programm(i8* %48)
store i32 0, i32* %3
br label %50
50: ; preds = %44, %11
%51 = load i32, i32* %3
ret i32 %51
}

LLVM IR (-O2):
@.str.2 = [9 x i8] c"T panic\0A\00"
@.str.3 = [35 x i8] c"Kernel Panic Handler Address:\09%lx\0A\00"
@.str.4 = [22 x i8] c"t kasan_report_error\0A\00"
@.str.5 = [35 x i8] c"Kernel KASAN Handler Address:\09%lx\0A\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@str = [42 x i8] c"<< kAFL Usermode Load for Linux x86-64 >>\00"
@str.6 = [35 x i8] c"Loader requires root privileges...\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = tail call i64 (...) @geteuid()
%4 = icmp eq i64 %3, 0
br i1 %4, label %8, label %5
5: ; preds = %2
%6 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([42 x i8], [42 x i8]* @str, i64 0, i64 0))
%7 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([35 x i8], [35 x i8]* @str.6, i64 0, i64 0))
br label %35
8: ; preds = %2
%9 = tail call i32 @get_address(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.2, i64 0, i64 0))
%10 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([35 x i8], [35 x i8]* @.str.3, i64 0, i64 0), i32 %9)
%11 = tail call i32 @get_address(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.4, i64 0, i64 0))
%12 = icmp eq i32 %11, 0
br i1 %12, label %15, label %13
13: ; preds = %8
%14 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([35 x i8], [35 x i8]* @.str.5, i64 0, i64 0), i32 %11)
br label %15
15: ; preds = %13, %8
%16 = load i32, i32* @PROT_READ
%17 = load i32, i32* @PROT_WRITE
%18 = or i32 %17, %16
%19 = load i32, i32* @MAP_PRIVATE
%20 = load i32, i32* @MAP_ANONYMOUS
%21 = or i32 %20, %19
%22 = tail call i8* @mmap(i8* inttoptr (i64 2882338816 to i8*), i32 16777216, i32 %18, i32 %21, i32 -1, i32 0)
%23 = tail call i32 @memset(i8* %22, i32 255, i32 16777216)
%24 = tail call i32 @kAFL_hypercall(i32 10, i32 0)
%25 = tail call i32 @kAFL_hypercall(i32 0, i32 0)
%26 = tail call i32 @kAFL_hypercall(i32 4, i32 0)
%27 = tail call i32 @kAFL_hypercall(i32 6, i32 %9)
br i1 %12, label %30, label %28
28: ; preds = %15
%29 = tail call i32 @kAFL_hypercall(i32 7, i32 %11)
br label %30
30: ; preds = %28, %15
%31 = ptrtoint i8* %22 to i64
%32 = trunc i64 %31 to i32
%33 = tail call i32 @kAFL_hypercall(i32 2, i32 %32)
%34 = tail call i32 @load_programm(i8* %22)
br label %35
35: ; preds = %30, %5
%36 = phi i32 [ 1, %5 ], [ 0, %30 ]
ret i32 %36
}