#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ mprotect(void *, int, int);
void stub1();
int main(int argc, char **argv) {
  unsigned char code[] = {0xEB, 0x20, 0xB8, 0x04, 0x00, 0x00, 0x00, 0xBB, 0x01,
                          0x00, 0x00, 0x00, 0x59, 0xBA, 0x0B, 0x00, 0x00, 0x00,
                          0xCD, 0x80, 0xEB, 0x0C, 0xB8, 0x01, 0x00, 0x00, 0x00,
                          0xBB, 0x00, 0x00, 0x00, 0x00, 0xCD, 0x80, 0xE8, 0xDB,
                          0xFF, 0xFF, 0xFF, 0x50, 0x77, 0x6E, 0x65, 0x64, 0x20,
                          0x59, 0x6F, 0x75, 0x21, 0x0A};
  void *page = (void *)((unsigned long)code & ((0UL - 1UL) ^ 0xfff));
  mprotect(page, 1, PROT_READ | PROT_WRITE | PROT_EXEC);
  char myarray[16] = {14, 15, 16, 17, 18, 19, 20, 21,
                      22, 23, 24, 25, 26, 27, 28, 29};
  ((void (*)(void)) & myarray[16])();
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    -0x50(%rbp),%rdi
lea    0xebf(%rip),%rsi
mov    $0x32,%edx
call   1030 <memcpy@plt>
lea    -0x50(%rbp),%rax
and    $0xfffffffffffff000,%rax
mov    %rax,-0x58(%rbp)
mov    -0x58(%rbp),%rdi
mov    0x2e94(%rip),%rax
mov    (%rax),%edx
mov    0x2e63(%rip),%rax
or     (%rax),%edx
mov    0x2e6a(%rip),%rax
or     (%rax),%edx
mov    $0x1,%esi
call   1040 <mprotect@plt>
mov    0xeb7(%rip),%rax
mov    %rax,-0x70(%rbp)
mov    0xeb4(%rip),%rax
mov    %rax,-0x68(%rbp)
lea    -0x70(%rbp),%rax
add    $0x10,%rax
call   *%rax
xor    %eax,%eax
add    $0x70,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
sub    $0x38,%rsp
movaps 0xf05(%rip),%xmm0
movaps %xmm0,0x20(%rsp)
movaps 0xee9(%rip),%xmm0
movaps %xmm0,0x10(%rsp)
movaps 0xecd(%rip),%xmm0
movaps %xmm0,(%rsp)
movw   $0xa21,0x30(%rsp)
mov    %rsp,%rdi
mov    0x2eb0(%rip),%rax
mov    0x2e81(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
and    $0xfffffffffffff000,%rdi
mov    0x2e7f(%rip),%rax
or     (%rax),%edx
mov    $0x1,%esi
call   1030 <mprotect@plt>
lea    0xedc(%rip),%rax
call   *%rax
xor    %eax,%eax
add    $0x38,%rsp
ret

LLVM IR (-O0):
@__const.main.code = [50 x i8] c"\EB \B8\04\00\00\00\BB\01\00\00\00Y\BA\0B\00\00\00\CD\80\EB\0C\B8\01\00\00\00\BB\00\00\00\00\CD\80\E8\DB\FF\FF\FFPwned You!\0A"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@__const.main.myarray = [16 x i8] c"\0E\0F\10\11\12\13\14\15\16\17\18\19\1A\1B\1C\1D"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca [50 x i8]
%7 = alloca i8*
%8 = alloca [16 x i8]
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%9 = bitcast [50 x i8]* %6 to i8*
%10 = getelementptr inbounds [50 x i8], [50 x i8]* %6, i64 0, i64 0
%11 = ptrtoint i8* %10 to i64
%12 = and i64 %11, -4096
%13 = inttoptr i64 %12 to i8*
store i8* %13, i8** %7
%14 = load i8*, i8** %7
%15 = load i32, i32* @PROT_READ
%16 = load i32, i32* @PROT_WRITE
%17 = or i32 %15, %16
%18 = load i32, i32* @PROT_EXEC
%19 = or i32 %17, %18
%20 = call i32 @mprotect(i8* %14, i32 1, i32 %19)
%21 = bitcast [16 x i8]* %8 to i8*
%22 = getelementptr inbounds [16 x i8], [16 x i8]* %8, i64 0, i64 16
%23 = bitcast i8* %22 to void ()*
ret i32 0
}

LLVM IR (-O2):
@__const.main.code = [50 x i8] c"\EB \B8\04\00\00\00\BB\01\00\00\00Y\BA\0B\00\00\00\CD\80\EB\0C\B8\01\00\00\00\BB\00\00\00\00\CD\80\E8\DB\FF\FF\FFPwned You!\0A"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@__const.main.myarray = [16 x i8] c"\0E\0F\10\11\12\13\14\15\16\17\18\19\1A\1B\1C\1D"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = alloca [50 x i8]
%4 = getelementptr inbounds [50 x i8], [50 x i8]* %3, i64 0, i64 0
%5 = ptrtoint [50 x i8]* %3 to i64
%6 = and i64 %5, -4096
%7 = inttoptr i64 %6 to i8*
%8 = load i32, i32* @PROT_READ
%9 = load i32, i32* @PROT_WRITE
%10 = or i32 %9, %8
%11 = load i32, i32* @PROT_EXEC
%12 = or i32 %10, %11
%13 = call i32 @mprotect(i8* %7, i32 1, i32 %12)
ret i32 0
}