#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_10__ TYPE_3__;
typedef struct TYPE_9__ TYPE_1__;

/* Type definitions */
struct TYPE_10__ {
  scalar_t__ r_offset;
  int /*<<< orphan*/ r_info;
};
struct TYPE_9__ {
  int sh_size;
  scalar_t__ sh_addr;
};
typedef TYPE_1__ Elf64_Sym;
typedef TYPE_1__ Elf64_Shdr;
typedef TYPE_3__ Elf64_Rela;

/* Variables and functions */
size_t ELF64_R_SYM(int /*<<< orphan*/);
int /*<<< orphan*/ O_RDONLY;
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ SHT_DYNSYM;
int /*<<< orphan*/ _SC_PAGESIZE;
int /*<<< orphan*/ close(int);
scalar_t__ errno;
int /*<<< orphan*/ free(TYPE_1__ *);
int /*<<< orphan*/ mprotect(void *, size_t, int);
int open(char const *, int /*<<< orphan*/);
scalar_t__ section_by_name(int, char *, TYPE_1__ **);
scalar_t__ section_by_type(int, int /*<<< orphan*/, TYPE_1__ **);
scalar_t__ symbol_by_name(int, TYPE_1__ *, char const *, TYPE_1__ **, size_t *);
size_t sysconf(int /*<<< orphan*/);
void *elf_hook(char const *module_filename, void const *module_address,
               char const *name, void const *substitution) {
  static size_t pagesize;
  int descriptor;
  Elf64_Shdr *dynsym = NULL, *rel_plt = NULL, *rel_dyn = NULL;
  Elf64_Sym *symbol = NULL;
  Elf64_Rela *rel_plt_table = NULL, *rel_dyn_table = NULL;
  size_t i, name_index, rel_plt_amount, rel_dyn_amount, *name_address = NULL;
  void *original = NULL;
  if (NULL == module_address || NULL == name || NULL == substitution)
    return original;
  if (!pagesize)
    pagesize = sysconf(_SC_PAGESIZE);
  descriptor = open(module_filename, O_RDONLY);
  if (descriptor < 0)
    return original;
  if (section_by_type(descriptor, SHT_DYNSYM, &dynsym) || NULL == dynsym ||
      symbol_by_name(descriptor, dynsym, name, &symbol, &name_index) ||
      NULL == symbol || section_by_name(descriptor, ".rela.plt", &rel_plt) ||
      NULL == rel_plt || section_by_name(descriptor, ".rela.dyn", &rel_dyn) ||
      NULL == rel_dyn) {
    free(dynsym);
    free(rel_plt);
    free(rel_dyn);
    free(symbol);
    close(descriptor);
    return original;
  }
  free(dynsym);
  free(symbol);
  rel_plt_table = (Elf64_Rela *)(((size_t)module_address) + rel_plt->sh_addr);
  rel_plt_amount = rel_plt->sh_size / sizeof(Elf64_Rela);
  rel_dyn_table = (Elf64_Rela *)(((size_t)module_address) + rel_dyn->sh_addr);
  rel_dyn_amount = rel_dyn->sh_size / sizeof(Elf64_Rela);
  free(rel_plt);
  free(rel_dyn);
  close(descriptor);
  for (i = 0; i < rel_plt_amount; ++i)
    if (ELF64_R_SYM(rel_plt_table[i].r_info) == name_index) {
      name_address =
          (size_t *)(((size_t)module_address) + rel_plt_table[i].r_offset);
      mprotect(
          (void *)(((size_t)name_address) & (((size_t)-1) ^ (pagesize - 1))),
          pagesize, PROT_READ | PROT_WRITE);
      original = (void *)*name_address;
      *name_address = (size_t)substitution;
      break;
    }
  if (original)
    return original;
  for (i = 0; i < rel_dyn_amount; ++i)
    if (ELF64_R_SYM(rel_dyn_table[i].r_info) == name_index) {
      name_address =
          (size_t *)(((size_t)module_address) + rel_dyn_table[i].r_offset);
      if (!original)
        original =
            (void *)(*name_address + (size_t)name_address + sizeof(size_t));
      mprotect(
          (void *)(((size_t)name_address) & (((size_t)-1) ^ (pagesize - 1))),
          pagesize, PROT_READ | PROT_WRITE);
      if (errno)
        return NULL;
      *name_address =
          (size_t)substitution - (size_t)name_address - sizeof(size_t);
      mprotect(
          (void *)(((size_t)name_address) & (((size_t)-1) ^ (pagesize - 1))),
          pagesize, PROT_READ | PROT_EXEC);
      if (errno) {
        *name_address =
            (size_t)original - (size_t)name_address - sizeof(size_t);
        return NULL;
      }
    }
  return original;
}


x86 assembly (clang, -O0):
<elf_hook>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
movq   $0x0,-0x38(%rbp)
movq   $0x0,-0x40(%rbp)
movq   $0x0,-0x48(%rbp)
movq   $0x0,-0x50(%rbp)
movq   $0x0,-0x58(%rbp)
movq   $0x0,-0x60(%rbp)
movq   $0x0,-0x88(%rbp)
movq   $0x0,-0x90(%rbp)
xor    %eax,%eax
cmp    -0x18(%rbp),%rax
je     1215 <elf_hook+0x85>
xor    %eax,%eax
cmp    -0x20(%rbp),%rax
je     1215 <elf_hook+0x85>
xor    %eax,%eax
cmp    -0x28(%rbp),%rax
jne    1225 <elf_hook+0x95>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    1637 <elf_hook+0x4a7>
cmpq   $0x0,0x2e43(%rip)
jne    1248 <elf_hook+0xb8>
mov    0x2d96(%rip),%rax
mov    (%rax),%edi
call   10a0 <sysconf@plt>
mov    %rax,0x2e28(%rip)
mov    -0x10(%rbp),%rdi
mov    0x2d8d(%rip),%rax
mov    (%rax),%esi
call   1090 <open@plt>
mov    %eax,-0x2c(%rbp)
cmpl   $0x0,-0x2c(%rbp)
jge    1277 <elf_hook+0xe7>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    1637 <elf_hook+0x4a7>
mov    -0x2c(%rbp),%edi
mov    0x2d57(%rip),%rax
mov    (%rax),%esi
lea    -0x38(%rbp),%rdx
call   10b0 <section_by_type@plt>
cmp    $0x0,%rax
jne    1322 <elf_hook+0x192>
xor    %eax,%eax
cmp    -0x38(%rbp),%rax
je     1322 <elf_hook+0x192>
mov    -0x2c(%rbp),%edi
mov    -0x38(%rbp),%rsi
mov    -0x20(%rbp),%rdx
lea    -0x50(%rbp),%rcx
lea    -0x70(%rbp),%r8
call   1060 <symbol_by_name@plt>
cmp    $0x0,%rax
jne    1322 <elf_hook+0x192>
xor    %eax,%eax
cmp    -0x50(%rbp),%rax
je     1322 <elf_hook+0x192>
mov    -0x2c(%rbp),%edi
lea    0xd26(%rip),%rsi
lea    -0x40(%rbp),%rdx
call   1070 <section_by_name@plt>
cmp    $0x0,%rax
jne    1322 <elf_hook+0x192>
xor    %eax,%eax
cmp    -0x40(%rbp),%rax
je     1322 <elf_hook+0x192>
mov    -0x2c(%rbp),%edi
lea    0xd07(%rip),%rsi
lea    -0x48(%rbp),%rdx
call   1070 <section_by_name@plt>
cmp    $0x0,%rax
jne    1322 <elf_hook+0x192>
xor    %eax,%eax
cmp    -0x48(%rbp),%rax
jne    135e <elf_hook+0x1ce>
mov    -0x38(%rbp),%rdi
call   1030 <free@plt>
mov    -0x40(%rbp),%rdi
call   1030 <free@plt>
mov    -0x48(%rbp),%rdi
call   1030 <free@plt>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
mov    -0x2c(%rbp),%edi
call   1040 <close@plt>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    1637 <elf_hook+0x4a7>
mov    -0x38(%rbp),%rdi
call   1030 <free@plt>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
mov    -0x18(%rbp),%rax
mov    -0x40(%rbp),%rcx
add    0x8(%rcx),%rax
mov    %rax,-0x58(%rbp)
mov    -0x40(%rbp),%rax
movslq (%rax),%rax
shr    $0x4,%rax
mov    %rax,-0x78(%rbp)
mov    -0x18(%rbp),%rax
mov    -0x48(%rbp),%rcx
add    0x8(%rcx),%rax
mov    %rax,-0x60(%rbp)
mov    -0x48(%rbp),%rax
movslq (%rax),%rax
shr    $0x4,%rax
mov    %rax,-0x80(%rbp)
mov    -0x40(%rbp),%rdi
call   1030 <free@plt>
mov    -0x48(%rbp),%rdi
call   1030 <free@plt>
mov    -0x2c(%rbp),%edi
call   1040 <close@plt>
movq   $0x0,-0x68(%rbp)
mov    -0x68(%rbp),%rax
cmp    -0x78(%rbp),%rax
jae    148d <elf_hook+0x2fd>
mov    -0x58(%rbp),%rax
mov    -0x68(%rbp),%rcx
shl    $0x4,%rcx
add    %rcx,%rax
mov    0x8(%rax),%edi
call   1050 <ELF64_R_SYM@plt>
cmp    -0x70(%rbp),%rax
jne    1477 <elf_hook+0x2e7>
mov    -0x18(%rbp),%rax
mov    -0x58(%rbp),%rcx
mov    -0x68(%rbp),%rdx
shl    $0x4,%rdx
add    %rdx,%rcx
add    (%rcx),%rax
mov    %rax,-0x88(%rbp)
mov    -0x88(%rbp),%rdi
mov    0x2c46(%rip),%rax
sub    $0x1,%rax
xor    $0xffffffffffffffff,%rax
and    %rax,%rdi
mov    0x2c34(%rip),%rsi
mov    0x2bb5(%rip),%rax
mov    (%rax),%edx
mov    0x2b64(%rip),%rax
or     (%rax),%edx
call   1080 <mprotect@plt>
mov    -0x88(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x90(%rbp)
mov    -0x28(%rbp),%rcx
mov    -0x88(%rbp),%rax
mov    %rcx,(%rax)
jmp    148d <elf_hook+0x2fd>
jmp    147c <elf_hook+0x2ec>
mov    -0x68(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x68(%rbp)
jmp    13d0 <elf_hook+0x240>
cmpq   $0x0,-0x90(%rbp)
je     14ab <elf_hook+0x31b>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    1637 <elf_hook+0x4a7>
movq   $0x0,-0x68(%rbp)
mov    -0x68(%rbp),%rax
cmp    -0x80(%rbp),%rax
jae    162c <elf_hook+0x49c>
mov    -0x60(%rbp),%rax
mov    -0x68(%rbp),%rcx
shl    $0x4,%rcx
add    %rcx,%rax
mov    0x8(%rax),%edi
call   1050 <ELF64_R_SYM@plt>
cmp    -0x70(%rbp),%rax
jne    1616 <elf_hook+0x486>
mov    -0x18(%rbp),%rax
mov    -0x60(%rbp),%rcx
mov    -0x68(%rbp),%rdx
shl    $0x4,%rdx
add    %rdx,%rcx
add    (%rcx),%rax
mov    %rax,-0x88(%rbp)
cmpq   $0x0,-0x90(%rbp)
jne    152c <elf_hook+0x39c>
mov    -0x88(%rbp),%rax
mov    (%rax),%rax
mov    -0x88(%rbp),%rcx
add    %rcx,%rax
add    $0x8,%rax
mov    %rax,-0x90(%rbp)
mov    -0x88(%rbp),%rdi
mov    0x2b36(%rip),%rax
sub    $0x1,%rax
xor    $0xffffffffffffffff,%rax
and    %rax,%rdi
mov    0x2b24(%rip),%rsi
mov    0x2aa5(%rip),%rax
mov    (%rax),%edx
mov    0x2a54(%rip),%rax
or     (%rax),%edx
call   1080 <mprotect@plt>
mov    0x2a4e(%rip),%rax
cmpq   $0x0,(%rax)
je     1581 <elf_hook+0x3f1>
movq   $0x0,-0x8(%rbp)
jmp    1637 <elf_hook+0x4a7>
mov    -0x28(%rbp),%rcx
mov    -0x88(%rbp),%rax
sub    %rax,%rcx
sub    $0x8,%rcx
mov    -0x88(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x88(%rbp),%rdi
mov    0x2ac5(%rip),%rax
sub    $0x1,%rax
xor    $0xffffffffffffffff,%rax
and    %rax,%rdi
mov    0x2ab3(%rip),%rsi
mov    0x2a34(%rip),%rax
mov    (%rax),%edx
mov    0x29fb(%rip),%rax
or     (%rax),%edx
call   1080 <mprotect@plt>
mov    0x29dd(%rip),%rax
cmpq   $0x0,(%rax)
je     1611 <elf_hook+0x481>
mov    -0x90(%rbp),%rcx
mov    -0x88(%rbp),%rax
sub    %rax,%rcx
sub    $0x8,%rcx
mov    -0x88(%rbp),%rax
mov    %rcx,(%rax)
movq   $0x0,-0x8(%rbp)
jmp    1637 <elf_hook+0x4a7>
jmp    1616 <elf_hook+0x486>
jmp    161b <elf_hook+0x48b>
mov    -0x68(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x68(%rbp)
jmp    14b3 <elf_hook+0x323>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x90,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<elf_hook>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x38,%rsp
movq   $0x0,0x20(%rsp)
movq   $0x0,0x18(%rsp)
movq   $0x0,0x8(%rsp)
movq   $0x0,0x10(%rsp)
xor    %r12d,%r12d
test   %rsi,%rsi
je     1386 <elf_hook+0x1f6>
mov    %rdx,%rbx
test   %rdx,%rdx
je     1386 <elf_hook+0x1f6>
mov    %rcx,%r14
test   %rcx,%rcx
je     1386 <elf_hook+0x1f6>
mov    %rsi,%r15
mov    %rdi,%rbp
cmpq   $0x0,0x2e7c(%rip)
jne    120b <elf_hook+0x7b>
mov    0x2dd3(%rip),%rax
mov    (%rax),%edi
call   10a0 <sysconf@plt>
mov    %rax,0x2e65(%rip)
mov    0x2dce(%rip),%rax
mov    (%rax),%esi
mov    %rbp,%rdi
call   1090 <open@plt>
test   %eax,%eax
js     1383 <elf_hook+0x1f3>
mov    %eax,%ebp
mov    0x2dab(%rip),%rax
mov    (%rax),%esi
lea    0x20(%rsp),%rdx
mov    %ebp,%edi
call   10b0 <section_by_type@plt>
test   %rax,%rax
jne    1354 <elf_hook+0x1c4>
mov    0x20(%rsp),%rsi
test   %rsi,%rsi
je     1354 <elf_hook+0x1c4>
lea    0x10(%rsp),%rcx
lea    0x30(%rsp),%r8
mov    %ebp,%edi
mov    %rbx,%rdx
call   1060 <symbol_by_name@plt>
test   %rax,%rax
jne    1354 <elf_hook+0x1c4>
cmpq   $0x0,0x10(%rsp)
je     1354 <elf_hook+0x1c4>
lea    0xd7e(%rip),%rsi
lea    0x18(%rsp),%rdx
mov    %ebp,%edi
call   1070 <section_by_name@plt>
test   %rax,%rax
jne    1354 <elf_hook+0x1c4>
cmpq   $0x0,0x18(%rsp)
je     1354 <elf_hook+0x1c4>
lea    0xd60(%rip),%rsi
lea    0x8(%rsp),%rdx
mov    %ebp,%edi
call   1070 <section_by_name@plt>
test   %rax,%rax
jne    1354 <elf_hook+0x1c4>
cmpq   $0x0,0x8(%rsp)
je     1354 <elf_hook+0x1c4>
mov    0x20(%rsp),%rdi
call   1030 <free@plt>
mov    0x10(%rsp),%rdi
call   1030 <free@plt>
mov    0x18(%rsp),%rdi
mov    0x8(%rdi),%rbx
add    %r15,%rbx
movslq (%rdi),%r12
mov    0x8(%rsp),%rax
mov    0x8(%rax),%r13
add    %r15,%r13
movslq (%rax),%rax
mov    %rax,0x28(%rsp)
call   1030 <free@plt>
mov    0x8(%rsp),%rdi
call   1030 <free@plt>
mov    %ebp,%edi
call   1040 <close@plt>
cmp    $0x10,%r12
jb     13d4 <elf_hook+0x244>
shr    $0x4,%r12
cmp    $0x2,%r12
mov    $0x1,%ebp
cmovae %r12,%rbp
add    $0x8,%rbx
mov    (%rbx),%edi
call   1050 <ELF64_R_SYM@plt>
cmp    0x30(%rsp),%rax
je     1398 <elf_hook+0x208>
add    $0x10,%rbx
add    $0xffffffffffffffff,%rbp
jne    1337 <elf_hook+0x1a7>
jmp    13d4 <elf_hook+0x244>
mov    0x20(%rsp),%rdi
call   1030 <free@plt>
mov    0x18(%rsp),%rdi
call   1030 <free@plt>
mov    0x8(%rsp),%rdi
call   1030 <free@plt>
mov    0x10(%rsp),%rdi
call   1030 <free@plt>
mov    %ebp,%edi
call   1040 <close@plt>
xor    %r12d,%r12d
mov    %r12,%rax
add    $0x38,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    -0x8(%rbx),%rbx
lea    (%rbx,%r15,1),%rax
mov    0x2cc9(%rip),%rsi
mov    %rsi,%rdi
neg    %rdi
and    %rax,%rdi
mov    0x2c41(%rip),%rax
mov    0x2bf2(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
call   1080 <mprotect@plt>
mov    (%rbx,%r15,1),%r12
mov    %r14,(%rbx,%r15,1)
test   %r12,%r12
jne    1386 <elf_hook+0x1f6>
mov    0x28(%rsp),%rax
cmp    $0x10,%eax
jb     1383 <elf_hook+0x1f3>
shr    $0x4,%rax
add    $0xfffffffffffffff8,%r14
cmp    $0x2,%rax
mov    $0x1,%ebp
cmovae %rax,%rbp
add    $0x8,%r13
xor    %r12d,%r12d
jmp    1406 <elf_hook+0x276>
add    $0x10,%r13
add    $0xffffffffffffffff,%rbp
je     1386 <elf_hook+0x1f6>
mov    0x0(%r13),%edi
call   1050 <ELF64_R_SYM@plt>
cmp    0x30(%rsp),%rax
jne    13fc <elf_hook+0x26c>
mov    %r13,0x28(%rsp)
mov    -0x8(%r13),%rbx
add    %r15,%rbx
test   %r12,%r12
jne    1432 <elf_hook+0x2a2>
mov    (%rbx),%rax
lea    (%rbx,%rax,1),%r12
add    $0x8,%r12
mov    0x2c37(%rip),%rsi
mov    %rsi,%rdi
neg    %rdi
and    %rbx,%rdi
mov    0x2b67(%rip),%rax
mov    (%rax),%edx
mov    0x2ba6(%rip),%r13
or     0x0(%r13),%edx
call   1080 <mprotect@plt>
mov    0x2b56(%rip),%rax
cmpq   $0x0,(%rax)
jne    1383 <elf_hook+0x1f3>
mov    %r14,%rax
sub    %rbx,%rax
mov    %rax,(%rbx)
mov    0x2bf4(%rip),%rsi
mov    %rsi,%rdi
neg    %rdi
and    %rbx,%rdi
mov    0x2b3c(%rip),%rax
mov    (%rax),%edx
or     0x0(%r13),%edx
call   1080 <mprotect@plt>
mov    0x2b1a(%rip),%rax
cmpq   $0x0,(%rax)
jne    14ae <elf_hook+0x31e>
mov    0x28(%rsp),%r13
jmp    13fc <elf_hook+0x26c>
sub    %rbx,%r12
add    $0xfffffffffffffff8,%r12
mov    %r12,(%rbx)
jmp    1383 <elf_hook+0x1f3>

LLVM IR (-O0):
%struct.TYPE_9__ = type { i32, i64 }
%struct.TYPE_10__ = type { i64, i32 }
@elf_hook.pagesize = internal global i64 0
@_SC_PAGESIZE = global i32 0
@O_RDONLY = global i32 0
@SHT_DYNSYM = global i32 0
@.str = [10 x i8] c".rela.plt\00"
@.str.1 = [10 x i8] c".rela.dyn\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@errno = global i64 0
@PROT_EXEC = global i32 0
define i8* @elf_hook(i8* %0, i8* %1, i8* %2, i8* %3) {
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i32
%11 = alloca %struct.TYPE_9__*
%12 = alloca %struct.TYPE_9__*
%13 = alloca %struct.TYPE_9__*
%14 = alloca %struct.TYPE_9__*
%15 = alloca %struct.TYPE_10__*
%16 = alloca %struct.TYPE_10__*
%17 = alloca i64
%18 = alloca i64
%19 = alloca i64
%20 = alloca i64
%21 = alloca i64*
%22 = alloca i8*
store i8* %0, i8** %6
store i8* %1, i8** %7
store i8* %2, i8** %8
store i8* %3, i8** %9
store %struct.TYPE_9__* null, %struct.TYPE_9__** %11
store %struct.TYPE_9__* null, %struct.TYPE_9__** %12
store %struct.TYPE_9__* null, %struct.TYPE_9__** %13
store %struct.TYPE_9__* null, %struct.TYPE_9__** %14
store %struct.TYPE_10__* null, %struct.TYPE_10__** %15
store %struct.TYPE_10__* null, %struct.TYPE_10__** %16
store i64* null, i64** %21
store i8* null, i8** %22
%23 = load i8*, i8** %7
%24 = icmp eq i8* null, %23
br i1 %24, label %31, label %25
25: ; preds = %4
%26 = load i8*, i8** %8
%27 = icmp eq i8* null, %26
br i1 %27, label %31, label %28
28: ; preds = %25
%29 = load i8*, i8** %9
%30 = icmp eq i8* null, %29
br i1 %30, label %31, label %33
31: ; preds = %28, %25, %4
%32 = load i8*, i8** %22
store i8* %32, i8** %5
br label %262
33: ; preds = %28
%34 = load i64, i64* @elf_hook.pagesize
%35 = icmp ne i64 %34, 0
br i1 %35, label %39, label %36
36: ; preds = %33
%37 = load i32, i32* @_SC_PAGESIZE
%38 = call i64 @sysconf(i32 %37)
store i64 %38, i64* @elf_hook.pagesize
br label %39
39: ; preds = %36, %33
%40 = load i8*, i8** %6
%41 = load i32, i32* @O_RDONLY
%42 = call i32 @open(i8* %40, i32 %41)
store i32 %42, i32* %10
%43 = load i32, i32* %10
%44 = icmp slt i32 %43, 0
br i1 %44, label %45, label %47
45: ; preds = %39
%46 = load i8*, i8** %22
store i8* %46, i8** %5
br label %262
47: ; preds = %39
%48 = load i32, i32* %10
%49 = load i32, i32* @SHT_DYNSYM
%50 = call i64 @section_by_type(i32 %48, i32 %49, %struct.TYPE_9__** %11)
%51 = icmp ne i64 %50, 0
br i1 %51, label %78, label %52
52: ; preds = %47
%53 = load %struct.TYPE_9__*, %struct.TYPE_9__** %11
%54 = icmp eq %struct.TYPE_9__* null, %53
br i1 %54, label %78, label %55
55: ; preds = %52
%56 = load i32, i32* %10
%57 = load %struct.TYPE_9__*, %struct.TYPE_9__** %11
%58 = load i8*, i8** %8
%59 = call i64 @symbol_by_name(i32 %56, %struct.TYPE_9__* %57, i8* %58, %struct.TYPE_9__** %14, i64* %18)
%60 = icmp ne i64 %59, 0
br i1 %60, label %78, label %61
61: ; preds = %55
%62 = load %struct.TYPE_9__*, %struct.TYPE_9__** %14
%63 = icmp eq %struct.TYPE_9__* null, %62
br i1 %63, label %78, label %64
64: ; preds = %61
%65 = load i32, i32* %10
%66 = call i64 @section_by_name(i32 %65, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), %struct.TYPE_9__** %12)
%67 = icmp ne i64 %66, 0
br i1 %67, label %78, label %68
68: ; preds = %64
%69 = load %struct.TYPE_9__*, %struct.TYPE_9__** %12
%70 = icmp eq %struct.TYPE_9__* null, %69
br i1 %70, label %78, label %71
71: ; preds = %68
%72 = load i32, i32* %10
%73 = call i64 @section_by_name(i32 %72, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0), %struct.TYPE_9__** %13)
%74 = icmp ne i64 %73, 0
br i1 %74, label %78, label %75
75: ; preds = %71
%76 = load %struct.TYPE_9__*, %struct.TYPE_9__** %13
%77 = icmp eq %struct.TYPE_9__* null, %76
br i1 %77, label %78, label %90
78: ; preds = %75, %71, %68, %64, %61, %55, %52, %47
%79 = load %struct.TYPE_9__*, %struct.TYPE_9__** %11
%80 = call i32 @free(%struct.TYPE_9__* %79)
%81 = load %struct.TYPE_9__*, %struct.TYPE_9__** %12
%82 = call i32 @free(%struct.TYPE_9__* %81)
%83 = load %struct.TYPE_9__*, %struct.TYPE_9__** %13
%84 = call i32 @free(%struct.TYPE_9__* %83)
%85 = load %struct.TYPE_9__*, %struct.TYPE_9__** %14
%86 = call i32 @free(%struct.TYPE_9__* %85)
%87 = load i32, i32* %10
%88 = call i32 @close(i32 %87)
%89 = load i8*, i8** %22
store i8* %89, i8** %5
br label %262
90: ; preds = %75
%91 = load %struct.TYPE_9__*, %struct.TYPE_9__** %11
%92 = call i32 @free(%struct.TYPE_9__* %91)
%93 = load %struct.TYPE_9__*, %struct.TYPE_9__** %14
%94 = call i32 @free(%struct.TYPE_9__* %93)
%95 = load i8*, i8** %7
%96 = ptrtoint i8* %95 to i64
%97 = load %struct.TYPE_9__*, %struct.TYPE_9__** %12
%98 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %97, i32 0, i32 1
%99 = load i64, i64* %98
%100 = add i64 %96, %99
%101 = inttoptr i64 %100 to %struct.TYPE_10__*
store %struct.TYPE_10__* %101, %struct.TYPE_10__** %15
%102 = load %struct.TYPE_9__*, %struct.TYPE_9__** %12
%103 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %102, i32 0, i32 0
%104 = load i32, i32* %103
%105 = sext i32 %104 to i64
%106 = udiv i64 %105, 16
store i64 %106, i64* %19
%107 = load i8*, i8** %7
%108 = ptrtoint i8* %107 to i64
%109 = load %struct.TYPE_9__*, %struct.TYPE_9__** %13
%110 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %109, i32 0, i32 1
%111 = load i64, i64* %110
%112 = add i64 %108, %111
%113 = inttoptr i64 %112 to %struct.TYPE_10__*
store %struct.TYPE_10__* %113, %struct.TYPE_10__** %16
%114 = load %struct.TYPE_9__*, %struct.TYPE_9__** %13
%115 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %114, i32 0, i32 0
%116 = load i32, i32* %115
%117 = sext i32 %116 to i64
%118 = udiv i64 %117, 16
store i64 %118, i64* %20
%119 = load %struct.TYPE_9__*, %struct.TYPE_9__** %12
%120 = call i32 @free(%struct.TYPE_9__* %119)
%121 = load %struct.TYPE_9__*, %struct.TYPE_9__** %13
%122 = call i32 @free(%struct.TYPE_9__* %121)
%123 = load i32, i32* %10
%124 = call i32 @close(i32 %123)
store i64 0, i64* %17
br label %125
125: ; preds = %167, %90
%126 = load i64, i64* %17
%127 = load i64, i64* %19
%128 = icmp ult i64 %126, %127
br i1 %128, label %129, label %170
129: ; preds = %125
%130 = load %struct.TYPE_10__*, %struct.TYPE_10__** %15
%131 = load i64, i64* %17
%132 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %130, i64 %131
%133 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %132, i32 0, i32 1
%134 = load i32, i32* %133
%135 = call i64 @ELF64_R_SYM(i32 %134)
%136 = load i64, i64* %18
%137 = icmp eq i64 %135, %136
br i1 %137, label %138, label %166
138: ; preds = %129
%139 = load i8*, i8** %7
%140 = ptrtoint i8* %139 to i64
%141 = load %struct.TYPE_10__*, %struct.TYPE_10__** %15
%142 = load i64, i64* %17
%143 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %141, i64 %142
%144 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %143, i32 0, i32 0
%145 = load i64, i64* %144
%146 = add i64 %140, %145
%147 = inttoptr i64 %146 to i64*
store i64* %147, i64** %21
%148 = load i64*, i64** %21
%149 = ptrtoint i64* %148 to i64
%150 = load i64, i64* @elf_hook.pagesize
%151 = sub i64 %150, 1
%152 = xor i64 -1, %151
%153 = and i64 %149, %152
%154 = inttoptr i64 %153 to i8*
%155 = load i64, i64* @elf_hook.pagesize
%156 = load i32, i32* @PROT_READ
%157 = load i32, i32* @PROT_WRITE
%158 = or i32 %156, %157
%159 = call i32 @mprotect(i8* %154, i64 %155, i32 %158)
%160 = load i64*, i64** %21
%161 = load i64, i64* %160
%162 = inttoptr i64 %161 to i8*
store i8* %162, i8** %22
%163 = load i8*, i8** %9
%164 = ptrtoint i8* %163 to i64
%165 = load i64*, i64** %21
store i64 %164, i64* %165
br label %170
166: ; preds = %129
br label %167
167: ; preds = %166
%168 = load i64, i64* %17
%169 = add i64 %168, 1
store i64 %169, i64* %17
br label %125
170: ; preds = %138, %125
%171 = load i8*, i8** %22
%172 = icmp ne i8* %171, null
br i1 %172, label %173, label %175
173: ; preds = %170
%174 = load i8*, i8** %22
store i8* %174, i8** %5
br label %262
175: ; preds = %170
store i64 0, i64* %17
br label %176
176: ; preds = %257, %175
%177 = load i64, i64* %17
%178 = load i64, i64* %20
%179 = icmp ult i64 %177, %178
br i1 %179, label %180, label %260
180: ; preds = %176
%181 = load %struct.TYPE_10__*, %struct.TYPE_10__** %16
%182 = load i64, i64* %17
%183 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %181, i64 %182
%184 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %183, i32 0, i32 1
%185 = load i32, i32* %184
%186 = call i64 @ELF64_R_SYM(i32 %185)
%187 = load i64, i64* %18
%188 = icmp eq i64 %186, %187
br i1 %188, label %189, label %256
189: ; preds = %180
%190 = load i8*, i8** %7
%191 = ptrtoint i8* %190 to i64
%192 = load %struct.TYPE_10__*, %struct.TYPE_10__** %16
%193 = load i64, i64* %17
%194 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %192, i64 %193
%195 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %194, i32 0, i32 0
%196 = load i64, i64* %195
%197 = add i64 %191, %196
%198 = inttoptr i64 %197 to i64*
store i64* %198, i64** %21
%199 = load i8*, i8** %22
%200 = icmp ne i8* %199, null
br i1 %200, label %209, label %201
201: ; preds = %189
%202 = load i64*, i64** %21
%203 = load i64, i64* %202
%204 = load i64*, i64** %21
%205 = ptrtoint i64* %204 to i64
%206 = add i64 %203, %205
%207 = add i64 %206, 8
%208 = inttoptr i64 %207 to i8*
store i8* %208, i8** %22
br label %209
209: ; preds = %201, %189
%210 = load i64*, i64** %21
%211 = ptrtoint i64* %210 to i64
%212 = load i64, i64* @elf_hook.pagesize
%213 = sub i64 %212, 1
%214 = xor i64 -1, %213
%215 = and i64 %211, %214
%216 = inttoptr i64 %215 to i8*
%217 = load i64, i64* @elf_hook.pagesize
%218 = load i32, i32* @PROT_READ
%219 = load i32, i32* @PROT_WRITE
%220 = or i32 %218, %219
%221 = call i32 @mprotect(i8* %216, i64 %217, i32 %220)
%222 = load i64, i64* @errno
%223 = icmp ne i64 %222, 0
br i1 %223, label %224, label %225
224: ; preds = %209
store i8* null, i8** %5
br label %262
225: ; preds = %209
%226 = load i8*, i8** %9
%227 = ptrtoint i8* %226 to i64
%228 = load i64*, i64** %21
%229 = ptrtoint i64* %228 to i64
%230 = sub i64 %227, %229
%231 = sub i64 %230, 8
%232 = load i64*, i64** %21
store i64 %231, i64* %232
%233 = load i64*, i64** %21
%234 = ptrtoint i64* %233 to i64
%235 = load i64, i64* @elf_hook.pagesize
%236 = sub i64 %235, 1
%237 = xor i64 -1, %236
%238 = and i64 %234, %237
%239 = inttoptr i64 %238 to i8*
%240 = load i64, i64* @elf_hook.pagesize
%241 = load i32, i32* @PROT_READ
%242 = load i32, i32* @PROT_EXEC
%243 = or i32 %241, %242
%244 = call i32 @mprotect(i8* %239, i64 %240, i32 %243)
%245 = load i64, i64* @errno
%246 = icmp ne i64 %245, 0
br i1 %246, label %247, label %255
247: ; preds = %225
%248 = load i8*, i8** %22
%249 = ptrtoint i8* %248 to i64
%250 = load i64*, i64** %21
%251 = ptrtoint i64* %250 to i64
%252 = sub i64 %249, %251
%253 = sub i64 %252, 8
%254 = load i64*, i64** %21
store i64 %253, i64* %254
store i8* null, i8** %5
br label %262
255: ; preds = %225
br label %256
256: ; preds = %255, %180
br label %257
257: ; preds = %256
%258 = load i64, i64* %17
%259 = add i64 %258, 1
store i64 %259, i64* %17
br label %176
260: ; preds = %176
%261 = load i8*, i8** %22
store i8* %261, i8** %5
br label %262
262: ; preds = %260, %247, %224, %173, %78, %45, %31
%263 = load i8*, i8** %5
ret i8* %263
}

LLVM IR (-O2):
%struct.TYPE_9__ = type { i32, i64 }
%struct.TYPE_10__ = type { i64, i32 }
@elf_hook.pagesize = internal unnamed_addr global i64 0
@_SC_PAGESIZE = global i32 0
@O_RDONLY = global i32 0
@SHT_DYNSYM = global i32 0
@.str = [10 x i8] c".rela.plt\00"
@.str.1 = [10 x i8] c".rela.dyn\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@errno = global i64 0
@PROT_EXEC = global i32 0
define i8* @elf_hook(i8* nocapture %0, i8* %1, i8* %2, i8* %3) {
%5 = alloca %struct.TYPE_9__*
%6 = alloca %struct.TYPE_9__*
%7 = alloca %struct.TYPE_9__*
%8 = alloca %struct.TYPE_9__*
%9 = alloca i64
%10 = bitcast %struct.TYPE_9__** %5 to i8*
store %struct.TYPE_9__* null, %struct.TYPE_9__** %5
%11 = bitcast %struct.TYPE_9__** %6 to i8*
store %struct.TYPE_9__* null, %struct.TYPE_9__** %6
%12 = bitcast %struct.TYPE_9__** %7 to i8*
store %struct.TYPE_9__* null, %struct.TYPE_9__** %7
%13 = bitcast %struct.TYPE_9__** %8 to i8*
store %struct.TYPE_9__* null, %struct.TYPE_9__** %8
%14 = bitcast i64* %9 to i8*
%15 = icmp eq i8* %1, null
%16 = icmp eq i8* %2, null
%17 = or i1 %15, %16
%18 = icmp eq i8* %3, null
%19 = or i1 %17, %18
br i1 %19, label %181, label %20
20: ; preds = %4
%21 = load i64, i64* @elf_hook.pagesize
%22 = icmp eq i64 %21, 0
br i1 %22, label %23, label %26
23: ; preds = %20
%24 = load i32, i32* @_SC_PAGESIZE
%25 = tail call i64 @sysconf(i32 %24)
store i64 %25, i64* @elf_hook.pagesize
br label %26
26: ; preds = %23, %20
%27 = load i32, i32* @O_RDONLY
%28 = tail call i32 @open(i8* %0, i32 %27)
%29 = icmp slt i32 %28, 0
br i1 %29, label %181, label %30
30: ; preds = %26
%31 = load i32, i32* @SHT_DYNSYM
%32 = call i64 @section_by_type(i32 %28, i32 %31, %struct.TYPE_9__** %5)
%33 = icmp ne i64 %32, 0
%34 = load %struct.TYPE_9__*, %struct.TYPE_9__** %5
%35 = icmp eq %struct.TYPE_9__* %34, null
%36 = select i1 %33, i1 true, i1 %35
br i1 %36, label %55, label %37
37: ; preds = %30
%38 = call i64 @symbol_by_name(i32 %28, %struct.TYPE_9__* %34, i8* %2, %struct.TYPE_9__** %8, i64* %9)
%39 = icmp ne i64 %38, 0
%40 = load %struct.TYPE_9__*, %struct.TYPE_9__** %8
%41 = icmp eq %struct.TYPE_9__* %40, null
%42 = select i1 %39, i1 true, i1 %41
br i1 %42, label %55, label %43
43: ; preds = %37
%44 = call i64 @section_by_name(i32 %28, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), %struct.TYPE_9__** %6)
%45 = icmp ne i64 %44, 0
%46 = load %struct.TYPE_9__*, %struct.TYPE_9__** %6
%47 = icmp eq %struct.TYPE_9__* %46, null
%48 = select i1 %45, i1 true, i1 %47
br i1 %48, label %55, label %49
49: ; preds = %43
%50 = call i64 @section_by_name(i32 %28, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0), %struct.TYPE_9__** %7)
%51 = icmp ne i64 %50, 0
%52 = load %struct.TYPE_9__*, %struct.TYPE_9__** %7
%53 = icmp eq %struct.TYPE_9__* %52, null
%54 = select i1 %51, i1 true, i1 %53
br i1 %54, label %55, label %65
55: ; preds = %49, %43, %37, %30
%56 = load %struct.TYPE_9__*, %struct.TYPE_9__** %5
%57 = call i32 @free(%struct.TYPE_9__* %56)
%58 = load %struct.TYPE_9__*, %struct.TYPE_9__** %6
%59 = call i32 @free(%struct.TYPE_9__* %58)
%60 = load %struct.TYPE_9__*, %struct.TYPE_9__** %7
%61 = call i32 @free(%struct.TYPE_9__* %60)
%62 = load %struct.TYPE_9__*, %struct.TYPE_9__** %8
%63 = call i32 @free(%struct.TYPE_9__* %62)
%64 = call i32 @close(i32 %28)
br label %181
65: ; preds = %49
%66 = load %struct.TYPE_9__*, %struct.TYPE_9__** %5
%67 = call i32 @free(%struct.TYPE_9__* %66)
%68 = load %struct.TYPE_9__*, %struct.TYPE_9__** %8
%69 = call i32 @free(%struct.TYPE_9__* %68)
%70 = ptrtoint i8* %1 to i64
%71 = load %struct.TYPE_9__*, %struct.TYPE_9__** %6
%72 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %71, i64 0, i32 1
%73 = load i64, i64* %72
%74 = add i64 %73, %70
%75 = inttoptr i64 %74 to %struct.TYPE_10__*
%76 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %71, i64 0, i32 0
%77 = load i32, i32* %76
%78 = load %struct.TYPE_9__*, %struct.TYPE_9__** %7
%79 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %78, i64 0, i32 1
%80 = load i64, i64* %79
%81 = add i64 %80, %70
%82 = inttoptr i64 %81 to %struct.TYPE_10__*
%83 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %78, i64 0, i32 0
%84 = load i32, i32* %83
%85 = sext i32 %84 to i64
%86 = lshr i64 %85, 4
%87 = call i32 @free(%struct.TYPE_9__* %71)
%88 = load %struct.TYPE_9__*, %struct.TYPE_9__** %7
%89 = call i32 @free(%struct.TYPE_9__* %88)
%90 = call i32 @close(i32 %28)
%91 = icmp ult i32 %77, 16
br i1 %91, label %123, label %92
92: ; preds = %65
%93 = sext i32 %77 to i64
%94 = lshr i64 %93, 4
%95 = call i64 @llvm.umax.i64(i64 %94, i64 1)
br label %96
96: ; preds = %92, %103
%97 = phi i64 [ %104, %103 ], [ 0, %92 ]
%98 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %75, i64 %97, i32 1
%99 = load i32, i32* %98
%100 = call i64 @ELF64_R_SYM(i32 %99)
%101 = load i64, i64* %9
%102 = icmp eq i64 %100, %101
br i1 %102, label %106, label %103
103: ; preds = %96
%104 = add nuw nsw i64 %97, 1
%105 = icmp eq i64 %104, %95
br i1 %105, label %123, label %96
106: ; preds = %96
%107 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %75, i64 %97, i32 0
%108 = load i64, i64* %107
%109 = add i64 %108, %70
%110 = inttoptr i64 %109 to i64*
%111 = load i64, i64* @elf_hook.pagesize
%112 = sub i64 0, %111
%113 = and i64 %109, %112
%114 = inttoptr i64 %113 to i8*
%115 = load i32, i32* @PROT_READ
%116 = load i32, i32* @PROT_WRITE
%117 = or i32 %116, %115
%118 = call i32 @mprotect(i8* %114, i64 %111, i32 %117)
%119 = load i64, i64* %110
%120 = inttoptr i64 %119 to i8*
%121 = ptrtoint i8* %3 to i64
store i64 %121, i64* %110
%122 = icmp eq i64 %119, 0
br i1 %122, label %123, label %181
123: ; preds = %103, %65, %106
%124 = icmp ult i32 %84, 16
br i1 %124, label %181, label %125
125: ; preds = %123
%126 = ptrtoint i8* %3 to i64
%127 = add i64 %126, -8
%128 = call i64 @llvm.umax.i64(i64 %86, i64 1)
br label %129
129: ; preds = %125, %177
%130 = phi i8* [ null, %125 ], [ %178, %177 ]
%131 = phi i64 [ 0, %125 ], [ %179, %177 ]
%132 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %82, i64 %131, i32 1
%133 = load i32, i32* %132
%134 = call i64 @ELF64_R_SYM(i32 %133)
%135 = load i64, i64* %9
%136 = icmp eq i64 %134, %135
br i1 %136, label %137, label %177
137: ; preds = %129
%138 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %82, i64 %131, i32 0
%139 = load i64, i64* %138
%140 = add i64 %139, %70
%141 = inttoptr i64 %140 to i64*
%142 = icmp eq i8* %130, null
br i1 %142, label %143, label %148
143: ; preds = %137
%144 = load i64, i64* %141
%145 = add i64 %140, 8
%146 = add i64 %145, %144
%147 = inttoptr i64 %146 to i8*
br label %148
148: ; preds = %143, %137
%149 = phi i8* [ %130, %137 ], [ %147, %143 ]
%150 = load i64, i64* @elf_hook.pagesize
%151 = sub i64 0, %150
%152 = and i64 %140, %151
%153 = inttoptr i64 %152 to i8*
%154 = load i32, i32* @PROT_READ
%155 = load i32, i32* @PROT_WRITE
%156 = or i32 %155, %154
%157 = call i32 @mprotect(i8* %153, i64 %150, i32 %156)
%158 = load i64, i64* @errno
%159 = icmp eq i64 %158, 0
br i1 %159, label %160, label %181
160: ; preds = %148
%161 = sub i64 %127, %140
store i64 %161, i64* %141
%162 = load i64, i64* @elf_hook.pagesize
%163 = sub i64 0, %162
%164 = and i64 %140, %163
%165 = inttoptr i64 %164 to i8*
%166 = load i32, i32* @PROT_READ
%167 = load i32, i32* @PROT_EXEC
%168 = or i32 %167, %166
%169 = call i32 @mprotect(i8* %165, i64 %162, i32 %168)
%170 = load i64, i64* @errno
%171 = icmp eq i64 %170, 0
br i1 %171, label %177, label %172
172: ; preds = %160
%173 = inttoptr i64 %140 to i64*
%174 = ptrtoint i8* %149 to i64
%175 = sub i64 -8, %140
%176 = add i64 %175, %174
store i64 %176, i64* %173
br label %181
177: ; preds = %129, %160
%178 = phi i8* [ %149, %160 ], [ %130, %129 ]
%179 = add nuw nsw i64 %131, 1
%180 = icmp eq i64 %179, %128
br i1 %180, label %181, label %129
181: ; preds = %148, %177, %123, %106, %26, %4, %172, %55
%182 = phi i8* [ null, %55 ], [ null, %172 ], [ null, %4 ], [ null, %26 ], [ %120, %106 ], [ null, %123 ], [ null, %148 ], [ %178, %177 ]
ret i8* %182
}