#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, ...);
void printhelpNquit(char *name) {
  printf("Chaos controller  v1.3  by agentOfChaos  "
         "informaniac99<AT>gmail<DOT>com\n");
  printf("Small linux utility that lets you hack the libc random number "
         "generator, bypassing the C random() function and altering the "
         "rand()'s return value.\n");
  printf("In layman terms: if random number is god, you can be god too!\n\n");
  printf("Usage: %s [arguments]\n", name);
  printf("Mandatory arguments: offset_mode target inject_mode\n");
  printf("--help -h -?\tprint this help screen\n.");
  printf("[offset_mode]\t\"auto\" OR \"preset\"\n");
  printf("How the program will know the memory offset (from libc beginning) "
         "where to find rand() entry point.\n");
  printf("\tpreset will use the value defined at compile time.\n");
  printf(
      "\tauto will guess it based on it's location in the current program.\n");
  printf("[target]\tpid OR absolute_path\n");
  printf("The target process to manipulate\n");
  printf("\tpid of a running process. keep in mind however that you might "
         "require root privilege for that\n");
  printf("\tabsolute_path of a child process to spawn\n");
  printf("[inject_mode]\tnop OR num OR fix\n");
  printf("How the program will alterate target's memory\n");
  printf("\tnop will replace the call-to-random with NOPs (assembly opcode "
         "that does nothing)\n");
  printf("\tfix will restore the default value (a call to the random "
         "subroutine)\n");
  printf(
      "\tnum [my_number] will replace the call-to-random with MOV [my_number] "
      "to eax, basically making rand return your own number of choice.\n");
  printf("\nExample usage (sudo may be required):\n\t%s auto $(pidof killbots) "
         "num 4\n",
         name);
  printf("Then, to restore the program's unaltered memory: \n\t%s auto $(pidof "
         "killbots) fix\n",
         name);
  exit(0);
}


x86 assembly (clang, -O0):
<printhelpNquit>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    %rdi,-0x8(%rbp)
lea    0xecd(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf08(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xf8e(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%rsi
lea    0xfbc(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xfc5(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xfec(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1004(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1018(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x106f(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1096(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x10cc(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x10dd(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x10f1(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1143(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1161(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1174(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1195(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x11db(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0x1214(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%rsi
lea    0x1289(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%rsi
lea    0x12c0(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
xor    %edi,%edi
call   1040 <exit@plt>

x86 assembly (clang, -O2):
<printhelpNquit>:
push   %rbx
mov    %rdi,%rbx
lea    0xf9d(%rip),%rdi
call   1030 <puts@plt>
lea    0xfd9(%rip),%rdi
call   1030 <puts@plt>
lea    0x1060(%rip),%rdi
call   1030 <puts@plt>
lea    0xea1(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
lea    0x1082(%rip),%rdi
call   1030 <puts@plt>
lea    0xe9b(%rip),%rdi
xor    %eax,%eax
call   1040 <printf@plt>
lea    0x109c(%rip),%rdi
call   1030 <puts@plt>
lea    0x10b1(%rip),%rdi
call   1030 <puts@plt>
lea    0x1109(%rip),%rdi
call   1030 <puts@plt>
lea    0x1131(%rip),%rdi
call   1030 <puts@plt>
lea    0x1168(%rip),%rdi
call   1030 <puts@plt>
lea    0x117a(%rip),%rdi
call   1030 <puts@plt>
lea    0x118f(%rip),%rdi
call   1030 <puts@plt>
lea    0x11e2(%rip),%rdi
call   1030 <puts@plt>
lea    0x1201(%rip),%rdi
call   1030 <puts@plt>
lea    0x1215(%rip),%rdi
call   1030 <puts@plt>
lea    0x1237(%rip),%rdi
call   1030 <puts@plt>
lea    0x127e(%rip),%rdi
call   1030 <puts@plt>
lea    0x12b8(%rip),%rdi
call   1030 <puts@plt>
lea    0xe17(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
lea    0xe4f(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
xor    %edi,%edi
call   1050 <exit@plt>

LLVM IR (-O0):
@.str = [73 x i8] c"Chaos controller v1.3 by agentOfChaos informaniac99<AT>gmail<DOT>com\0A\00"
@.str.1 = [148 x i8] c"Small linux utility that lets you hack the libc random number generator, bypassing the C random() function and altering the rand()'s return value.\0A\00"
@.str.2 = [64 x i8] c"In layman terms: if random number is god, you can be god too!\0A\0A\00"
@.str.3 = [23 x i8] c"Usage: %s [arguments]\0A\00"
@.str.4 = [53 x i8] c"Mandatory arguments: offset_mode target inject_mode\0A\00"
@.str.5 = [38 x i8] c"--help -h -?\09print this help screen\0A.\00"
@.str.6 = [34 x i8] c"[offset_mode]\09\22auto\22 OR \22preset\22\0A\00"
@.str.7 = [101 x i8] c"How the program will know the memory offset (from libc beginning) where to find rand() entry point.\0A\00"
@.str.8 = [53 x i8] c"\09preset will use the value defined at compile time.\0A\00"
@.str.9 = [68 x i8] c"\09auto will guess it based on it's location in the current program.\0A\00"
@.str.10 = [31 x i8] c"[target]\09pid OR absolute_path\0A\00"
@.str.11 = [34 x i8] c"The target process to manipulate\0A\00"
@.str.12 = [96 x i8] c"\09pid of a running process. keep in mind however that you might require root privilege for that\0A\00"
@.str.13 = [44 x i8] c"\09absolute_path of a child process to spawn\0A\00"
@.str.14 = [33 x i8] c"[inject_mode]\09nop OR num OR fix\0A\00"
@.str.15 = [47 x i8] c"How the program will alterate target's memory\0A\00"
@.str.16 = [84 x i8] c"\09nop will replace the call-to-random with NOPs (assembly opcode that does nothing)\0A\00"
@.str.17 = [71 x i8] c"\09fix will restore the default value (a call to the random subroutine)\0A\00"
@.str.18 = [135 x i8] c"\09num [my_number] will replace the call-to-random with MOV [my_number] to eax, basically making rand return your own number of choice.\0A\00"
@.str.19 = [73 x i8] c"\0AExample usage (sudo may be required):\0A\09%s auto $(pidof killbots) num 4\0A\00"
@.str.20 = [82 x i8] c"Then, to restore the program's unaltered memory: \0A\09%s auto $(pidof killbots) fix\0A\00"
define void @printhelpNquit(i8* %0) {
%2 = alloca i8*
store i8* %0, i8** %2
%3 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([73 x i8], [73 x i8]* @.str, i64 0, i64 0))
%4 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([148 x i8], [148 x i8]* @.str.1, i64 0, i64 0))
%5 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([64 x i8], [64 x i8]* @.str.2, i64 0, i64 0))
%6 = load i8*, i8** %2
%7 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.3, i64 0, i64 0), i8* %6)
%8 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([53 x i8], [53 x i8]* @.str.4, i64 0, i64 0))
%9 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.5, i64 0, i64 0))
%10 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.6, i64 0, i64 0))
%11 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([101 x i8], [101 x i8]* @.str.7, i64 0, i64 0))
%12 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([53 x i8], [53 x i8]* @.str.8, i64 0, i64 0))
%13 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([68 x i8], [68 x i8]* @.str.9, i64 0, i64 0))
%14 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.10, i64 0, i64 0))
%15 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.11, i64 0, i64 0))
%16 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([96 x i8], [96 x i8]* @.str.12, i64 0, i64 0))
%17 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([44 x i8], [44 x i8]* @.str.13, i64 0, i64 0))
%18 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.14, i64 0, i64 0))
%19 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str.15, i64 0, i64 0))
%20 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([84 x i8], [84 x i8]* @.str.16, i64 0, i64 0))
%21 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([71 x i8], [71 x i8]* @.str.17, i64 0, i64 0))
%22 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([135 x i8], [135 x i8]* @.str.18, i64 0, i64 0))
%23 = load i8*, i8** %2
%24 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([73 x i8], [73 x i8]* @.str.19, i64 0, i64 0), i8* %23)
%25 = load i8*, i8** %2
%26 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([82 x i8], [82 x i8]* @.str.20, i64 0, i64 0), i8* %25)
%27 = call i32 @exit(i32 0)
unreachable
}

LLVM IR (-O2):
@.str.3 = [23 x i8] c"Usage: %s [arguments]\0A\00"
@.str.5 = [38 x i8] c"--help -h -?\09print this help screen\0A.\00"
@.str.19 = [73 x i8] c"\0AExample usage (sudo may be required):\0A\09%s auto $(pidof killbots) num 4\0A\00"
@.str.20 = [82 x i8] c"Then, to restore the program's unaltered memory: \0A\09%s auto $(pidof killbots) fix\0A\00"
@str = [72 x i8] c"Chaos controller v1.3 by agentOfChaos informaniac99<AT>gmail<DOT>com\00"
@str.21 = [147 x i8] c"Small linux utility that lets you hack the libc random number generator, bypassing the C random() function and altering the rand()'s return value.\00"
@str.22 = [63 x i8] c"In layman terms: if random number is god, you can be god too!\0A\00"
@str.23 = [52 x i8] c"Mandatory arguments: offset_mode target inject_mode\00"
@str.24 = [33 x i8] c"[offset_mode]\09\22auto\22 OR \22preset\22\00"
@str.25 = [100 x i8] c"How the program will know the memory offset (from libc beginning) where to find rand() entry point.\00"
@str.26 = [52 x i8] c"\09preset will use the value defined at compile time.\00"
@str.27 = [67 x i8] c"\09auto will guess it based on it's location in the current program.\00"
@str.28 = [30 x i8] c"[target]\09pid OR absolute_path\00"
@str.29 = [33 x i8] c"The target process to manipulate\00"
@str.30 = [95 x i8] c"\09pid of a running process. keep in mind however that you might require root privilege for that\00"
@str.31 = [43 x i8] c"\09absolute_path of a child process to spawn\00"
@str.32 = [32 x i8] c"[inject_mode]\09nop OR num OR fix\00"
@str.33 = [46 x i8] c"How the program will alterate target's memory\00"
@str.34 = [83 x i8] c"\09nop will replace the call-to-random with NOPs (assembly opcode that does nothing)\00"
@str.35 = [70 x i8] c"\09fix will restore the default value (a call to the random subroutine)\00"
@str.36 = [134 x i8] c"\09num [my_number] will replace the call-to-random with MOV [my_number] to eax, basically making rand return your own number of choice.\00"
define void @printhelpNquit(i8* %0) {
%2 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([72 x i8], [72 x i8]* @str, i64 0, i64 0))
%3 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([147 x i8], [147 x i8]* @str.21, i64 0, i64 0))
%4 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([63 x i8], [63 x i8]* @str.22, i64 0, i64 0))
%5 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.3, i64 0, i64 0), i8* %0)
%6 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([52 x i8], [52 x i8]* @str.23, i64 0, i64 0))
%7 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([38 x i8], [38 x i8]* @.str.5, i64 0, i64 0))
%8 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([33 x i8], [33 x i8]* @str.24, i64 0, i64 0))
%9 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([100 x i8], [100 x i8]* @str.25, i64 0, i64 0))
%10 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([52 x i8], [52 x i8]* @str.26, i64 0, i64 0))
%11 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([67 x i8], [67 x i8]* @str.27, i64 0, i64 0))
%12 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @str.28, i64 0, i64 0))
%13 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([33 x i8], [33 x i8]* @str.29, i64 0, i64 0))
%14 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([95 x i8], [95 x i8]* @str.30, i64 0, i64 0))
%15 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([43 x i8], [43 x i8]* @str.31, i64 0, i64 0))
%16 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([32 x i8], [32 x i8]* @str.32, i64 0, i64 0))
%17 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([46 x i8], [46 x i8]* @str.33, i64 0, i64 0))
%18 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([83 x i8], [83 x i8]* @str.34, i64 0, i64 0))
%19 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([70 x i8], [70 x i8]* @str.35, i64 0, i64 0))
%20 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([134 x i8], [134 x i8]* @str.36, i64 0, i64 0))
%21 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([73 x i8], [73 x i8]* @.str.19, i64 0, i64 0), i8* %0)
%22 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([82 x i8], [82 x i8]* @.str.20, i64 0, i64 0), i8* %0)
%23 = tail call i32 @exit(i32 0)
unreachable
}