#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef scalar_t__ pid_t;

/* Variables and functions */
int /*<<< orphan*/ execve(char *, char **, char **);
scalar_t__ fork();
int /*<<< orphan*/ kAFL_hypercall(int, int /*<<< orphan*/);
int /*<<< orphan*/ waitpid(int, int *, int /*<<< orphan*/);
void execute_program() {
  char *newenviron[] = {NULL};
  char *newargv[] = {"/tmp/fuzzing_engine", NULL};
  pid_t cpid;
  int status;
  cpid = fork();
  while (1) {
    if (!cpid) {
      execve("/tmp/fuzzing_engine", newargv, newenviron);
    } else {
      waitpid(-1, &status, 0);
      kAFL_hypercall(4, 0);
      cpid = fork();
    }
  }
}


x86 assembly (clang, -O0):
<execute_program>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
lea    -0x8(%rbp),%rdi
xor    %esi,%esi
mov    $0x8,%edx
call   1030 <memset@plt>
mov    0x2ca1(%rip),%rax
mov    %rax,-0x20(%rbp)
mov    0x2c9e(%rip),%rax
mov    %rax,-0x18(%rbp)
mov    $0x0,%al
call   1070 <fork@plt>
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x28(%rbp)
jne    11ad <execute_program+0x5d>
lea    -0x20(%rbp),%rsi
lea    -0x8(%rbp),%rdx
lea    0xe5d(%rip),%rdi
call   1040 <execve@plt>
jmp    11d4 <execute_program+0x84>
mov    $0xffffffff,%edi
lea    -0x2c(%rbp),%rsi
xor    %edx,%edx
call   1050 <waitpid@plt>
mov    $0x4,%edi
xor    %esi,%esi
call   1060 <kAFL_hypercall@plt>
mov    $0x0,%al
call   1070 <fork@plt>
mov    %rax,-0x28(%rbp)
jmp    1189 <execute_program+0x39>

x86 assembly (clang, -O2):
<execute_program>:
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x28,%rsp
movq   $0x0,(%rsp)
movaps 0x2cb6(%rip),%xmm0
movaps %xmm0,0x10(%rsp)
xor    %eax,%eax
call   1060 <fork@plt>
lea    0xe93(%rip),%r14
lea    0x10(%rsp),%r15
mov    %rsp,%r12
lea    0xc(%rsp),%rbx
test   %rax,%rax
je     11a7 <execute_program+0x67>
nop
mov    $0xffffffff,%edi
mov    %rbx,%rsi
xor    %edx,%edx
call   1040 <waitpid@plt>
mov    $0x4,%edi
xor    %esi,%esi
call   1050 <kAFL_hypercall@plt>
xor    %eax,%eax
call   1060 <fork@plt>
test   %rax,%rax
jne    1180 <execute_program+0x40>
mov    %r14,%rdi
mov    %r15,%rsi
mov    %r12,%rdx
call   1030 <execve@plt>
xor    %eax,%eax
test   %rax,%rax
jne    1180 <execute_program+0x40>
jmp    11a7 <execute_program+0x67>

LLVM IR (-O0):
@.str = [20 x i8] c"/tmp/fuzzing_engine\00"
@__const.execute_program.newargv = [2 x i8*] [i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str, i32 0, i32 0), i8* null]
define void @execute_program() {
%1 = alloca [1 x i8*]
%2 = alloca [2 x i8*]
%3 = alloca i64
%4 = alloca i32
%5 = bitcast [1 x i8*]* %1 to i8*
%6 = bitcast [2 x i8*]* %2 to i8*
%7 = call i64 (...) @fork()
store i64 %7, i64* %3
br label %8
8: ; preds = %0, %19
%9 = load i64, i64* %3
%10 = icmp ne i64 %9, 0
br i1 %10, label %15, label %11
11: ; preds = %8
%12 = getelementptr inbounds [2 x i8*], [2 x i8*]* %2, i64 0, i64 0
%13 = getelementptr inbounds [1 x i8*], [1 x i8*]* %1, i64 0, i64 0
%14 = call i32 @execve(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str, i64 0, i64 0), i8** %12, i8** %13)
br label %19
15: ; preds = %8
%16 = call i32 @waitpid(i32 -1, i32* %4, i32 0)
%17 = call i32 @kAFL_hypercall(i32 4, i32 0)
%18 = call i64 (...) @fork()
store i64 %18, i64* %3
br label %19
19: ; preds = %15, %11
br label %8
}

LLVM IR (-O2):
@.str = [20 x i8] c"/tmp/fuzzing_engine\00"
@__const.execute_program.newargv = [2 x i8*] [i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str, i32 0, i32 0), i8* null]
define void @execute_program() {
%1 = alloca [1 x i8*]
%2 = alloca [2 x i8*]
%3 = alloca i32
%4 = bitcast [1 x i8*]* %1 to i8*
%5 = bitcast [1 x i8*]* %1 to i64*
store i64 0, i64* %5
%6 = bitcast [2 x i8*]* %2 to i8*
%7 = bitcast i32* %3 to i8*
%8 = tail call i64 (...) @fork()
%9 = getelementptr inbounds [2 x i8*], [2 x i8*]* %2, i64 0, i64 0
%10 = getelementptr inbounds [1 x i8*], [1 x i8*]* %1, i64 0, i64 0
br label %11
11: ; preds = %20, %0
%12 = phi i64 [ %8, %0 ], [ %21, %20 ]
%13 = icmp eq i64 %12, 0
br i1 %13, label %14, label %16
14: ; preds = %11
%15 = call i32 @execve(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str, i64 0, i64 0), i8** %9, i8** %10)
br label %20
16: ; preds = %11
%17 = call i32 @waitpid(i32 -1, i32* %3, i32 0)
%18 = call i32 @kAFL_hypercall(i32 4, i32 0)
%19 = call i64 (...) @fork()
br label %20
20: ; preds = %16, %14
%21 = phi i64 [ %19, %16 ], [ 0, %14 ]
br label %11
}