#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ EXIT_FAILURE;
int /*<<< orphan*/ O_RDONLY;
int /*<<< orphan*/ PTRACE_ATTACH;
int /*<<< orphan*/ PTRACE_DETACH;
int /*<<< orphan*/ SEEK_SET;
int atoi(char *);
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char *, char *);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, ...);
int /*<<< orphan*/ free(unsigned char *);
int fwrite(unsigned char *, unsigned int, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ lseek(int, unsigned int, int /*<<< orphan*/);
scalar_t__ malloc(unsigned int);
int open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ ptrace(int /*<<< orphan*/, int, int /*<<< orphan*/ *,
                          int /*<<< orphan*/ *);
int read(int, unsigned char *, unsigned int);
int /*<<< orphan*/ sprintf(char *, char *, int);
int /*<<< orphan*/ stderr;
unsigned int strtoul(char *, int /*<<< orphan*/ *, int /*<<< orphan*/);
int /*<<< orphan*/ waitpid(int, int /*<<< orphan*/ *, int /*<<< orphan*/);
int main(int argc, char *argv[]) {
  int pid, i, fd;
  unsigned int saddr, eaddr, size;
  char procfname[256];
  unsigned char *buf;
  FILE *fp;
  if (argc != 4) {
    printf("Usage: %s pid startaddr endaddr\n", argv[0]);
    exit(EXIT_FAILURE);
  } else {
    pid = atoi(argv[1]);
    saddr = strtoul(argv[2], NULL, 0);
    eaddr = strtoul(argv[3], NULL, 0);
  }
  printf("PID: %d\n", pid);
  printf("Start Address: %d\n", saddr);
  printf("End Address: %d\n", eaddr);
  size = (eaddr - saddr);
  printf("Size: %fKB\n", size / 1024.0);
  buf = (char *)malloc(size);
  if (buf == NULL) {
    fprintf(stderr, "[!] memory allocate failure.");
    exit(EXIT_FAILURE);
  } else {
    printf("memory allocated.\n");
  }
  sprintf(procfname, "/proc/%d/mem", pid);
  fd = open(procfname, O_RDONLY);
  if (fd == -1) {
    fprintf(stderr, "[!] %s open failure.\n", procfname);
    free(buf);
    exit(EXIT_FAILURE);
  }
  ptrace(PTRACE_ATTACH, pid, NULL, NULL);
  printf("attached. waiting process..\n");
  waitpid(pid, NULL, 0);
  printf("working...\n");
  lseek(fd, saddr, SEEK_SET);
  if (read(fd, buf, size) == -1) {
    fprintf(stderr, "[!] memory read failure.\n");
  }
  ptrace(PTRACE_DETACH, pid, NULL, NULL);
  printf("detouched.\ndump complete.\n");
  close(fd);
  printf("write to file...\n");
  fp = fopen("memory.bin", "w");
  if (fwrite(buf, size, 1, fp) < 1) {
    fprintf(stderr, "[!] fwrite failure.\n");
  }
  fclose(fp);
  free(buf);
  printf("done.\n");
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x150,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
cmpl   $0x4,-0x8(%rbp)
je     1256 <main+0x46>
mov    -0x10(%rbp),%rax
mov    (%rax),%rsi
lea    0xdc7(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    0x2d69(%rip),%rax
mov    (%rax),%edi
call   1120 <exit@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1100 <atoi@plt>
mov    %eax,-0x14(%rbp)
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
xor    %eax,%eax
mov    %eax,%esi
xor    %edx,%edx
call   10f0 <strtoul@plt>
mov    %eax,-0x20(%rbp)
mov    -0x10(%rbp),%rax
mov    0x18(%rax),%rdi
xor    %eax,%eax
mov    %eax,%esi
xor    %edx,%edx
call   10f0 <strtoul@plt>
mov    %eax,-0x24(%rbp)
mov    -0x14(%rbp),%esi
lea    0xd8d(%rip),%rdi
xor    %eax,%eax
mov    %al,-0x141(%rbp)
call   1050 <printf@plt>
mov    -0x141(%rbp),%al
mov    -0x20(%rbp),%esi
lea    0xd79(%rip),%rdi
call   1050 <printf@plt>
mov    -0x141(%rbp),%al
mov    -0x24(%rbp),%esi
lea    0xd77(%rip),%rdi
call   1050 <printf@plt>
mov    -0x24(%rbp),%eax
mov    -0x20(%rbp),%ecx
sub    %ecx,%eax
mov    %eax,-0x28(%rbp)
mov    -0x28(%rbp),%eax
cvtsi2sd %rax,%xmm0
movsd  0xd12(%rip),%xmm1
divsd  %xmm1,%xmm0
lea    0xd5d(%rip),%rdi
mov    $0x1,%al
call   1050 <printf@plt>
mov    -0x28(%rbp),%edi
call   10a0 <malloc@plt>
mov    %rax,-0x138(%rbp)
cmpq   $0x0,-0x138(%rbp)
jne    1342 <main+0x132>
mov    0x2ca4(%rip),%rax
mov    (%rax),%edi
lea    0xd35(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    0x2c7d(%rip),%rax
mov    (%rax),%edi
call   1120 <exit@plt>
lea    0xd36(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    -0x130(%rbp),%rdi
mov    -0x14(%rbp),%edx
lea    0xd31(%rip),%rsi
call   1110 <sprintf@plt>
lea    -0x130(%rbp),%rdi
mov    0x2c74(%rip),%rax
mov    (%rax),%esi
call   10d0 <open@plt>
mov    %eax,-0x1c(%rbp)
cmpl   $0xffffffff,-0x1c(%rbp)
jne    13c0 <main+0x1b0>
mov    0x2c39(%rip),%rax
mov    (%rax),%edi
lea    -0x130(%rbp),%rdx
lea    0xd00(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    -0x138(%rbp),%rdi
call   1030 <free@plt>
mov    0x2bff(%rip),%rax
mov    (%rax),%edi
call   1120 <exit@plt>
mov    0x2c11(%rip),%rax
mov    (%rax),%edi
mov    -0x14(%rbp),%esi
xor    %eax,%eax
mov    %eax,%ecx
mov    %rcx,%rdx
call   10b0 <ptrace@plt>
lea    0xcd6(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x14(%rbp),%edi
xor    %eax,%eax
mov    %eax,%esi
xor    %edx,%edx
call   10c0 <waitpid@plt>
lea    0xcd7(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x1c(%rbp),%edi
mov    -0x20(%rbp),%esi
mov    0x2bb1(%rip),%rax
mov    (%rax),%edx
call   1060 <lseek@plt>
mov    -0x1c(%rbp),%edi
mov    -0x138(%rbp),%rsi
mov    -0x28(%rbp),%edx
call   1080 <read@plt>
cmp    $0xffffffff,%eax
jne    1448 <main+0x238>
mov    0x2b90(%rip),%rax
mov    (%rax),%edi
lea    0xc9d(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    0x2b91(%rip),%rax
mov    (%rax),%edi
mov    -0x14(%rbp),%esi
xor    %eax,%eax
mov    %eax,%ecx
mov    %rcx,%rdx
call   10b0 <ptrace@plt>
lea    0xc91(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x1c(%rbp),%edi
call   1070 <close@plt>
lea    0xc96(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xc9a(%rip),%rdi
lea    0xc9e(%rip),%rsi
call   10e0 <fopen@plt>
mov    %rax,-0x140(%rbp)
mov    -0x138(%rbp),%rdi
mov    -0x28(%rbp),%esi
mov    -0x140(%rbp),%rcx
mov    $0x1,%edx
call   1130 <fwrite@plt>
cmp    $0x1,%eax
jge    14d9 <main+0x2c9>
mov    0x2aff(%rip),%rax
mov    (%rax),%edi
lea    0xc60(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    -0x140(%rbp),%rdi
call   1040 <fclose@plt>
mov    -0x138(%rbp),%rdi
call   1030 <free@plt>
lea    0xc4f(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x4(%rbp),%eax
add    $0x150,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x100,%rsp
mov    %rsi,%rbx
cmp    $0x4,%edi
jne    141f <main+0x1ff>
mov    0x8(%rbx),%rdi
call   1110 <atoi@plt>
mov    %eax,%r12d
mov    0x10(%rbx),%rdi
xor    %esi,%esi
xor    %edx,%edx
call   1100 <strtoul@plt>
mov    %eax,%r15d
mov    0x18(%rbx),%rdi
xor    %esi,%esi
xor    %edx,%edx
call   1100 <strtoul@plt>
mov    %eax,%ebx
lea    0xdbc(%rip),%rdi
mov    %r12d,%esi
xor    %eax,%eax
call   1060 <printf@plt>
lea    0xdb4(%rip),%rdi
mov    %r15d,%esi
xor    %eax,%eax
call   1060 <printf@plt>
lea    0xdb6(%rip),%rdi
mov    %ebx,%esi
xor    %eax,%eax
call   1060 <printf@plt>
sub    %r15d,%ebx
cvtsi2sd %rbx,%xmm0
mulsd  0xd58(%rip),%xmm0
lea    0xda7(%rip),%rdi
mov    $0x1,%al
call   1060 <printf@plt>
mov    %ebx,%edi
call   10b0 <malloc@plt>
test   %rax,%rax
je     1432 <main+0x212>
mov    %rax,%r14
lea    0xe0e(%rip),%rdi
call   1040 <puts@plt>
lea    0xda3(%rip),%rsi
mov    %rsp,%rbp
mov    %rbp,%rdi
mov    %r12d,%edx
call   1120 <sprintf@plt>
mov    0x2cf7(%rip),%rax
mov    (%rax),%esi
mov    %rbp,%rdi
call   10e0 <open@plt>
cmp    $0xffffffff,%eax
je     144b <main+0x22b>
mov    %eax,%ebp
mov    0x2ccb(%rip),%rax
mov    (%rax),%edi
mov    %r12d,%esi
xor    %edx,%edx
xor    %ecx,%ecx
call   10c0 <ptrace@plt>
lea    0xdce(%rip),%rdi
call   1040 <puts@plt>
mov    %r12d,%edi
xor    %esi,%esi
xor    %edx,%edx
call   10d0 <waitpid@plt>
lea    0xdd2(%rip),%rdi
call   1040 <puts@plt>
mov    0x2c7a(%rip),%rax
mov    (%rax),%edx
mov    %ebp,%edi
mov    %r15d,%esi
call   1070 <lseek@plt>
mov    %ebp,%edi
mov    %r14,%rsi
mov    %ebx,%edx
call   1090 <read@plt>
cmp    $0xffffffff,%eax
jne    137a <main+0x15a>
mov    0x2c5e(%rip),%rax
mov    (%rax),%edi
lea    0xd2f(%rip),%rsi
xor    %eax,%eax
call   10a0 <fprintf@plt>
mov    0x2c5f(%rip),%rax
mov    (%rax),%edi
mov    %r12d,%esi
xor    %edx,%edx
xor    %ecx,%ecx
call   10c0 <ptrace@plt>
lea    0xd81(%rip),%rdi
call   1040 <puts@plt>
mov    %ebp,%edi
call   1080 <close@plt>
lea    0xd88(%rip),%rdi
call   1040 <puts@plt>
lea    0xd07(%rip),%rdi
lea    0xd0b(%rip),%rsi
call   10f0 <fopen@plt>
mov    %rax,%rbp
mov    %r14,%rdi
mov    %ebx,%esi
mov    $0x1,%edx
mov    %rax,%rcx
call   1140 <fwrite@plt>
test   %eax,%eax
jg     13f1 <main+0x1d1>
mov    0x2be7(%rip),%rax
mov    (%rax),%edi
lea    0xcdf(%rip),%rsi
xor    %eax,%eax
call   10a0 <fprintf@plt>
mov    %rbp,%rdi
call   1050 <fclose@plt>
mov    %r14,%rdi
call   1030 <free@plt>
lea    0xd3a(%rip),%rdi
call   1040 <puts@plt>
xor    %eax,%eax
add    $0x100,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
pop    %rbp
ret
mov    (%rbx),%rsi
lea    0xbdf(%rip),%rdi
xor    %eax,%eax
call   1060 <printf@plt>
jmp    146d <main+0x24d>
mov    0x2b8f(%rip),%rax
mov    (%rax),%edi
lea    0xc20(%rip),%rsi
xor    %eax,%eax
call   10a0 <fprintf@plt>
jmp    146d <main+0x24d>
mov    0x2b76(%rip),%rax
mov    (%rax),%edi
lea    0xc31(%rip),%rsi
mov    %rsp,%rdx
xor    %eax,%eax
call   10a0 <fprintf@plt>
mov    %r14,%rdi
call   1030 <free@plt>
mov    0x2b44(%rip),%rax
mov    (%rax),%edi
call   1130 <exit@plt>

LLVM IR (-O0):
@.str = [33 x i8] c"Usage: %s pid startaddr endaddr\0A\00"
@EXIT_FAILURE = global i32 0
@.str.1 = [9 x i8] c"PID: %d\0A\00"
@.str.2 = [19 x i8] c"Start Address: %d\0A\00"
@.str.3 = [17 x i8] c"End Address: %d\0A\00"
@.str.4 = [12 x i8] c"Size: %fKB\0A\00"
@stderr = global i32 0
@.str.5 = [29 x i8] c"[!] memory allocate failure.\00"
@.str.6 = [19 x i8] c"memory allocated.\0A\00"
@.str.7 = [13 x i8] c"/proc/%d/mem\00"
@O_RDONLY = global i32 0
@.str.8 = [22 x i8] c"[!] %s open failure.\0A\00"
@PTRACE_ATTACH = global i32 0
@.str.9 = [29 x i8] c"attached. waiting process..\0A\00"
@.str.10 = [12 x i8] c"working...\0A\00"
@SEEK_SET = global i32 0
@.str.11 = [26 x i8] c"[!] memory read failure.\0A\00"
@PTRACE_DETACH = global i32 0
@.str.12 = [27 x i8] c"detouched.\0Adump complete.\0A\00"
@.str.13 = [18 x i8] c"write to file...\0A\00"
@.str.14 = [11 x i8] c"memory.bin\00"
@.str.15 = [2 x i8] c"w\00"
@.str.16 = [21 x i8] c"[!] fwrite failure.\0A\00"
@.str.17 = [7 x i8] c"done.\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i32
%12 = alloca [256 x i8]
%13 = alloca i8*
%14 = alloca i32*
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%15 = load i32, i32* %4
%16 = icmp ne i32 %15, 4
br i1 %16, label %17, label %24
17: ; preds = %2
%18 = load i8**, i8*** %5
%19 = getelementptr inbounds i8*, i8** %18, i64 0
%20 = load i8*, i8** %19
%21 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str, i64 0, i64 0), i8* %20)
%22 = load i32, i32* @EXIT_FAILURE
%23 = call i32 @exit(i32 %22)
unreachable
24: ; preds = %2
%25 = load i8**, i8*** %5
%26 = getelementptr inbounds i8*, i8** %25, i64 1
%27 = load i8*, i8** %26
%28 = call i32 @atoi(i8* %27)
store i32 %28, i32* %6
%29 = load i8**, i8*** %5
%30 = getelementptr inbounds i8*, i8** %29, i64 2
%31 = load i8*, i8** %30
%32 = call i32 @strtoul(i8* %31, i32* null, i32 0)
store i32 %32, i32* %9
%33 = load i8**, i8*** %5
%34 = getelementptr inbounds i8*, i8** %33, i64 3
%35 = load i8*, i8** %34
%36 = call i32 @strtoul(i8* %35, i32* null, i32 0)
store i32 %36, i32* %10
br label %37
37: ; preds = %24
%38 = load i32, i32* %6
%39 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i32 %38)
%40 = load i32, i32* %9
%41 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.2, i64 0, i64 0), i32 %40)
%42 = load i32, i32* %10
%43 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.3, i64 0, i64 0), i32 %42)
%44 = load i32, i32* %10
%45 = load i32, i32* %9
%46 = sub i32 %44, %45
store i32 %46, i32* %11
%47 = load i32, i32* %11
%48 = uitofp i32 %47 to double
%49 = fdiv double %48, 1.024000e+03
%50 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.4, i64 0, i64 0), double %49)
%51 = load i32, i32* %11
%52 = call i64 @malloc(i32 %51)
%53 = inttoptr i64 %52 to i8*
store i8* %53, i8** %13
%54 = load i8*, i8** %13
%55 = icmp eq i8* %54, null
br i1 %55, label %56, label %61
56: ; preds = %37
%57 = load i32, i32* @stderr
%58 = call i32 (i32, i8*, ...) @fprintf(i32 %57, i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.5, i64 0, i64 0))
%59 = load i32, i32* @EXIT_FAILURE
%60 = call i32 @exit(i32 %59)
unreachable
61: ; preds = %37
%62 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.6, i64 0, i64 0))
br label %63
63: ; preds = %61
%64 = getelementptr inbounds [256 x i8], [256 x i8]* %12, i64 0, i64 0
%65 = load i32, i32* %6
%66 = call i32 @sprintf(i8* %64, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.7, i64 0, i64 0), i32 %65)
%67 = getelementptr inbounds [256 x i8], [256 x i8]* %12, i64 0, i64 0
%68 = load i32, i32* @O_RDONLY
%69 = call i32 @open(i8* %67, i32 %68)
store i32 %69, i32* %8
%70 = load i32, i32* %8
%71 = icmp eq i32 %70, -1
br i1 %71, label %72, label %80
72: ; preds = %63
%73 = load i32, i32* @stderr
%74 = getelementptr inbounds [256 x i8], [256 x i8]* %12, i64 0, i64 0
%75 = call i32 (i32, i8*, ...) @fprintf(i32 %73, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.8, i64 0, i64 0), i8* %74)
%76 = load i8*, i8** %13
%77 = call i32 @free(i8* %76)
%78 = load i32, i32* @EXIT_FAILURE
%79 = call i32 @exit(i32 %78)
unreachable
80: ; preds = %63
%81 = load i32, i32* @PTRACE_ATTACH
%82 = load i32, i32* %6
%83 = call i32 @ptrace(i32 %81, i32 %82, i32* null, i32* null)
%84 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.9, i64 0, i64 0))
%85 = load i32, i32* %6
%86 = call i32 @waitpid(i32 %85, i32* null, i32 0)
%87 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.10, i64 0, i64 0))
%88 = load i32, i32* %8
%89 = load i32, i32* %9
%90 = load i32, i32* @SEEK_SET
%91 = call i32 @lseek(i32 %88, i32 %89, i32 %90)
%92 = load i32, i32* %8
%93 = load i8*, i8** %13
%94 = load i32, i32* %11
%95 = call i32 @read(i32 %92, i8* %93, i32 %94)
%96 = icmp eq i32 %95, -1
br i1 %96, label %97, label %100
97: ; preds = %80
%98 = load i32, i32* @stderr
%99 = call i32 (i32, i8*, ...) @fprintf(i32 %98, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.11, i64 0, i64 0))
br label %100
100: ; preds = %97, %80
%101 = load i32, i32* @PTRACE_DETACH
%102 = load i32, i32* %6
%103 = call i32 @ptrace(i32 %101, i32 %102, i32* null, i32* null)
%104 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.12, i64 0, i64 0))
%105 = load i32, i32* %8
%106 = call i32 @close(i32 %105)
%107 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.13, i64 0, i64 0))
%108 = call i32* @fopen(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.14, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.15, i64 0, i64 0))
store i32* %108, i32** %14
%109 = load i8*, i8** %13
%110 = load i32, i32* %11
%111 = load i32*, i32** %14
%112 = call i32 @fwrite(i8* %109, i32 %110, i32 1, i32* %111)
%113 = icmp slt i32 %112, 1
br i1 %113, label %114, label %117
114: ; preds = %100
%115 = load i32, i32* @stderr
%116 = call i32 (i32, i8*, ...) @fprintf(i32 %115, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.16, i64 0, i64 0))
br label %117
117: ; preds = %114, %100
%118 = load i32*, i32** %14
%119 = call i32 @fclose(i32* %118)
%120 = load i8*, i8** %13
%121 = call i32 @free(i8* %120)
%122 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.17, i64 0, i64 0))
%123 = load i32, i32* %3
ret i32 %123
}

LLVM IR (-O2):
@.str = [33 x i8] c"Usage: %s pid startaddr endaddr\0A\00"
@EXIT_FAILURE = global i32 0
@.str.1 = [9 x i8] c"PID: %d\0A\00"
@.str.2 = [19 x i8] c"Start Address: %d\0A\00"
@.str.3 = [17 x i8] c"End Address: %d\0A\00"
@.str.4 = [12 x i8] c"Size: %fKB\0A\00"
@stderr = global i32 0
@.str.5 = [29 x i8] c"[!] memory allocate failure.\00"
@.str.7 = [13 x i8] c"/proc/%d/mem\00"
@O_RDONLY = global i32 0
@.str.8 = [22 x i8] c"[!] %s open failure.\0A\00"
@PTRACE_ATTACH = global i32 0
@SEEK_SET = global i32 0
@.str.11 = [26 x i8] c"[!] memory read failure.\0A\00"
@PTRACE_DETACH = global i32 0
@.str.14 = [11 x i8] c"memory.bin\00"
@.str.15 = [2 x i8] c"w\00"
@.str.16 = [21 x i8] c"[!] fwrite failure.\0A\00"
@str = [18 x i8] c"memory allocated.\00"
@str.18 = [28 x i8] c"attached. waiting process..\00"
@str.19 = [11 x i8] c"working...\00"
@str.20 = [26 x i8] c"detouched.\0Adump complete.\00"
@str.21 = [17 x i8] c"write to file...\00"
@str.22 = [6 x i8] c"done.\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca [256 x i8]
%4 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%5 = icmp eq i32 %0, 4
br i1 %5, label %11, label %6
6: ; preds = %2
%7 = load i8*, i8** %1
%8 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([33 x i8], [33 x i8]* @.str, i64 0, i64 0), i8* %7)
%9 = load i32, i32* @EXIT_FAILURE
%10 = tail call i32 @exit(i32 %9)
unreachable
11: ; preds = %2
%12 = getelementptr inbounds i8*, i8** %1, i64 1
%13 = load i8*, i8** %12
%14 = tail call i32 @atoi(i8* %13)
%15 = getelementptr inbounds i8*, i8** %1, i64 2
%16 = load i8*, i8** %15
%17 = tail call i32 @strtoul(i8* nocapture %16, i32* null, i32 0)
%18 = getelementptr inbounds i8*, i8** %1, i64 3
%19 = load i8*, i8** %18
%20 = tail call i32 @strtoul(i8* nocapture %19, i32* null, i32 0)
%21 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str.1, i64 0, i64 0), i32 %14)
%22 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @.str.2, i64 0, i64 0), i32 %17)
%23 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([17 x i8], [17 x i8]* @.str.3, i64 0, i64 0), i32 %20)
%24 = sub i32 %20, %17
%25 = uitofp i32 %24 to double
%26 = fmul double %25, 0x3F50000000000000
%27 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([12 x i8], [12 x i8]* @.str.4, i64 0, i64 0), double %26)
%28 = tail call i64 @malloc(i32 %24)
%29 = inttoptr i64 %28 to i8*
%30 = icmp eq i64 %28, 0
br i1 %30, label %31, label %36
31: ; preds = %11
%32 = load i32, i32* @stderr
%33 = tail call i32 (i32, i8*, ...) @fprintf(i32 %32, i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.5, i64 0, i64 0))
%34 = load i32, i32* @EXIT_FAILURE
%35 = tail call i32 @exit(i32 %34)
unreachable
36: ; preds = %11
%37 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([18 x i8], [18 x i8]* @str, i64 0, i64 0))
%38 = call i32 @sprintf(i8* %4, i8* dereferenceable(1) getelementptr inbounds ([13 x i8], [13 x i8]* @.str.7, i64 0, i64 0), i32 %14)
%39 = load i32, i32* @O_RDONLY
%40 = call i32 @open(i8* %4, i32 %39)
%41 = icmp eq i32 %40, -1
br i1 %41, label %42, label %48
42: ; preds = %36
%43 = load i32, i32* @stderr
%44 = call i32 (i32, i8*, ...) @fprintf(i32 %43, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.8, i64 0, i64 0), i8* %4)
%45 = call i32 @free(i8* %29)
%46 = load i32, i32* @EXIT_FAILURE
%47 = call i32 @exit(i32 %46)
unreachable
48: ; preds = %36
%49 = load i32, i32* @PTRACE_ATTACH
%50 = tail call i32 @ptrace(i32 %49, i32 %14, i32* null, i32* null)
%51 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([28 x i8], [28 x i8]* @str.18, i64 0, i64 0))
%52 = tail call i32 @waitpid(i32 %14, i32* null, i32 0)
%53 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([11 x i8], [11 x i8]* @str.19, i64 0, i64 0))
%54 = load i32, i32* @SEEK_SET
%55 = tail call i32 @lseek(i32 %40, i32 %17, i32 %54)
%56 = tail call i32 @read(i32 %40, i8* %29, i32 %24)
%57 = icmp eq i32 %56, -1
br i1 %57, label %58, label %61
58: ; preds = %48
%59 = load i32, i32* @stderr
%60 = tail call i32 (i32, i8*, ...) @fprintf(i32 %59, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.11, i64 0, i64 0))
br label %61
61: ; preds = %58, %48
%62 = load i32, i32* @PTRACE_DETACH
%63 = tail call i32 @ptrace(i32 %62, i32 %14, i32* null, i32* null)
%64 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([26 x i8], [26 x i8]* @str.20, i64 0, i64 0))
%65 = tail call i32 @close(i32 %40)
%66 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([17 x i8], [17 x i8]* @str.21, i64 0, i64 0))
%67 = tail call i32* @fopen(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.14, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.15, i64 0, i64 0))
%68 = tail call i32 @fwrite(i8* %29, i32 %24, i32 1, i32* %67)
%69 = icmp slt i32 %68, 1
br i1 %69, label %70, label %73
70: ; preds = %61
%71 = load i32, i32* @stderr
%72 = tail call i32 (i32, i8*, ...) @fprintf(i32 %71, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.16, i64 0, i64 0))
br label %73
73: ; preds = %70, %61
%74 = tail call i32 @fclose(i32* %67)
%75 = tail call i32 @free(i8* %29)
%76 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @str.22, i64 0, i64 0))
ret i32 0
}