#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ cmd;

/* Variables and functions */
int /*<<< orphan*/ EXIT_FAILURE;
char *MAP_FAILED;
int /*<<< orphan*/ MAP_SHARED;
int /*<<< orphan*/ O_RDWR;
int /*<<< orphan*/ PROT_NONE;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ _SC_PAGESIZE;
int close(int);
int /*<<< orphan*/ exit(int /*<<< orphan*/);
scalar_t__ getpid();
char *mmap(int /*<<< orphan*/ *, int, int /*<<< orphan*/, int /*<<< orphan*/,
           int, int /*<<< orphan*/);
int mprotect(char *, int, int);
int open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ snprintf(char *, int, char *, long);
int sysconf(int /*<<< orphan*/);
int /*<<< orphan*/ system(char *);
int main(int argc, char **argv) {
  char cmd[100];
  char *addr;
  int fd, page_size;
  page_size = sysconf(_SC_PAGESIZE);
  if ((fd = open("/dev/zero", O_RDWR)) < 0) {
    perror("open() ");
    exit(EXIT_FAILURE);
  }
  addr = mmap(NULL, page_size, PROT_NONE, MAP_SHARED, fd, 0);
  if (addr == MAP_FAILED) {
    perror("mmap() ");
    exit(EXIT_FAILURE);
  }
  if (close(fd) == -1) {
    perror("close() ");
    exit(EXIT_FAILURE);
  }
  snprintf(cmd, sizeof(cmd), "cat /proc/%ld/maps | grep zero", (long)getpid());
  system(cmd);
  if (mprotect(addr, page_size, PROT_READ | PROT_WRITE) == -1) {
    perror("mprotect() ");
    exit(EXIT_FAILURE);
  }
  snprintf(cmd, sizeof(cmd), "cat /proc/%ld/maps | grep zero", (long)getpid());
  system(cmd);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0xa0,%rsp
mov    %edi,-0x4(%rbp)
mov    %rsi,-0x10(%rbp)
mov    0x2e0f(%rip),%rax
mov    (%rax),%edi
call   10b0 <sysconf@plt>
mov    %eax,-0x90(%rbp)
mov    0x2e03(%rip),%rax
mov    (%rax),%esi
lea    0xe2a(%rip),%rdi
call   1090 <open@plt>
mov    %eax,-0x8c(%rbp)
cmp    $0x0,%eax
jge    1204 <main+0x64>
lea    0xe19(%rip),%rdi
call   10a0 <perror@plt>
mov    0x2dbb(%rip),%rax
mov    (%rax),%edi
call   10c0 <exit@plt>
mov    -0x90(%rbp),%esi
mov    0x2dd7(%rip),%rax
mov    (%rax),%edx
mov    0x2dc6(%rip),%rax
mov    (%rax),%ecx
mov    -0x8c(%rbp),%r8d
xor    %eax,%eax
mov    %eax,%edi
xor    %r9d,%r9d
call   1040 <mmap@plt>
mov    %rax,-0x88(%rbp)
mov    -0x88(%rbp),%rax
mov    0x2d64(%rip),%rcx
cmp    (%rcx),%rax
jne    1267 <main+0xc7>
lea    0xdbe(%rip),%rdi
call   10a0 <perror@plt>
mov    0x2d58(%rip),%rax
mov    (%rax),%edi
call   10c0 <exit@plt>
mov    -0x8c(%rbp),%edi
call   1070 <close@plt>
cmp    $0xffffffff,%eax
jne    1295 <main+0xf5>
lea    0xd98(%rip),%rdi
call   10a0 <perror@plt>
mov    0x2d2a(%rip),%rax
mov    (%rax),%edi
call   10c0 <exit@plt>
lea    -0x80(%rbp),%rax
mov    %rax,-0x98(%rbp)
mov    $0x0,%al
call   1030 <getpid@plt>
mov    -0x98(%rbp),%rdi
mov    %rax,%rcx
mov    $0x64,%esi
lea    0xd66(%rip),%rdx
call   1060 <snprintf@plt>
lea    -0x80(%rbp),%rdi
call   1050 <system@plt>
mov    -0x88(%rbp),%rdi
mov    -0x90(%rbp),%esi
mov    0x2d19(%rip),%rax
mov    (%rax),%edx
mov    0x2cc8(%rip),%rax
or     (%rax),%edx
call   1080 <mprotect@plt>
cmp    $0xffffffff,%eax
jne    1312 <main+0x172>
lea    0xd43(%rip),%rdi
call   10a0 <perror@plt>
mov    0x2cad(%rip),%rax
mov    (%rax),%edi
call   10c0 <exit@plt>
lea    -0x80(%rbp),%rax
mov    %rax,-0xa0(%rbp)
mov    $0x0,%al
call   1030 <getpid@plt>
mov    -0xa0(%rbp),%rdi
mov    %rax,%rcx
mov    $0x64,%esi
lea    0xce9(%rip),%rdx
call   1060 <snprintf@plt>
lea    -0x80(%rbp),%rdi
call   1050 <system@plt>
xor    %eax,%eax
add    $0xa0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r14
push   %rbx
sub    $0x70,%rsp
mov    0x2e19(%rip),%rax
mov    (%rax),%edi
call   10b0 <sysconf@plt>
mov    %eax,%r14d
mov    0x2e10(%rip),%rax
mov    (%rax),%esi
lea    0xe37(%rip),%rdi
call   1090 <open@plt>
test   %eax,%eax
js     129c <main+0xfc>
mov    %eax,%ebp
mov    0x2e09(%rip),%rax
mov    (%rax),%edx
mov    0x2df8(%rip),%rax
mov    (%rax),%ecx
xor    %edi,%edi
mov    %r14d,%esi
mov    %ebp,%r8d
xor    %r9d,%r9d
call   1040 <mmap@plt>
mov    %rax,%rbx
mov    0x2da4(%rip),%rax
cmp    (%rax),%rbx
je     12a5 <main+0x105>
mov    %ebp,%edi
call   1070 <close@plt>
cmp    $0xffffffff,%eax
je     12ae <main+0x10e>
xor    %eax,%eax
call   1030 <getpid@plt>
lea    0xdf8(%rip),%rdx
mov    %rsp,%rbp
mov    %rbp,%rdi
mov    $0x64,%esi
mov    %rax,%rcx
call   1060 <snprintf@plt>
mov    %rbp,%rdi
call   1050 <system@plt>
mov    0x2dab(%rip),%rax
mov    0x2d5c(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
mov    %rbx,%rdi
mov    %r14d,%esi
call   1080 <mprotect@plt>
cmp    $0xffffffff,%eax
je     12b7 <main+0x117>
xor    %eax,%eax
call   1030 <getpid@plt>
lea    0xdad(%rip),%rdx
mov    %rsp,%rbx
mov    %rbx,%rdi
mov    $0x64,%esi
mov    %rax,%rcx
call   1060 <snprintf@plt>
mov    %rbx,%rdi
call   1050 <system@plt>
xor    %eax,%eax
add    $0x70,%rsp
pop    %rbx
pop    %r14
pop    %rbp
ret
lea    0xd67(%rip),%rdi
jmp    12be <main+0x11e>
lea    0xd66(%rip),%rdi
jmp    12be <main+0x11e>
lea    0xd65(%rip),%rdi
jmp    12be <main+0x11e>
lea    0xd84(%rip),%rdi
call   10a0 <perror@plt>
mov    0x2cee(%rip),%rax
mov    (%rax),%edi
call   10c0 <exit@plt>

LLVM IR (-O0):
@_SC_PAGESIZE = global i32 0
@.str = [10 x i8] c"/dev/zero\00"
@O_RDWR = global i32 0
@.str.1 = [8 x i8] c"open() \00"
@EXIT_FAILURE = global i32 0
@PROT_NONE = global i32 0
@MAP_SHARED = global i32 0
@MAP_FAILED = global i8* null
@.str.2 = [8 x i8] c"mmap() \00"
@.str.3 = [9 x i8] c"close() \00"
@.str.4 = [31 x i8] c"cat /proc/%ld/maps | grep zero\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@.str.5 = [12 x i8] c"mprotect() \00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i8**
%5 = alloca [100 x i8]
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i32
store i32 %0, i32* %3
store i8** %1, i8*** %4
%9 = load i32, i32* @_SC_PAGESIZE
%10 = call i32 @sysconf(i32 %9)
store i32 %10, i32* %8
%11 = load i32, i32* @O_RDWR
%12 = call i32 @open(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i32 %11)
store i32 %12, i32* %7
%13 = icmp slt i32 %12, 0
br i1 %13, label %14, label %18
14: ; preds = %2
%15 = call i32 @perror(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0))
%16 = load i32, i32* @EXIT_FAILURE
%17 = call i32 @exit(i32 %16)
unreachable
18: ; preds = %2
%19 = load i32, i32* %8
%20 = load i32, i32* @PROT_NONE
%21 = load i32, i32* @MAP_SHARED
%22 = load i32, i32* %7
%23 = call i8* @mmap(i32* null, i32 %19, i32 %20, i32 %21, i32 %22, i32 0)
store i8* %23, i8** %6
%24 = load i8*, i8** %6
%25 = load i8*, i8** @MAP_FAILED
%26 = icmp eq i8* %24, %25
br i1 %26, label %27, label %31
27: ; preds = %18
%28 = call i32 @perror(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0))
%29 = load i32, i32* @EXIT_FAILURE
%30 = call i32 @exit(i32 %29)
unreachable
31: ; preds = %18
%32 = load i32, i32* %7
%33 = call i32 @close(i32 %32)
%34 = icmp eq i32 %33, -1
br i1 %34, label %35, label %39
35: ; preds = %31
%36 = call i32 @perror(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0))
%37 = load i32, i32* @EXIT_FAILURE
%38 = call i32 @exit(i32 %37)
unreachable
39: ; preds = %31
%40 = getelementptr inbounds [100 x i8], [100 x i8]* %5, i64 0, i64 0
%41 = call i64 (...) @getpid()
%42 = call i32 @snprintf(i8* %40, i32 100, i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.4, i64 0, i64 0), i64 %41)
%43 = getelementptr inbounds [100 x i8], [100 x i8]* %5, i64 0, i64 0
%44 = call i32 @system(i8* %43)
%45 = load i8*, i8** %6
%46 = load i32, i32* %8
%47 = load i32, i32* @PROT_READ
%48 = load i32, i32* @PROT_WRITE
%49 = or i32 %47, %48
%50 = call i32 @mprotect(i8* %45, i32 %46, i32 %49)
%51 = icmp eq i32 %50, -1
br i1 %51, label %52, label %56
52: ; preds = %39
%53 = call i32 @perror(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.5, i64 0, i64 0))
%54 = load i32, i32* @EXIT_FAILURE
%55 = call i32 @exit(i32 %54)
unreachable
56: ; preds = %39
%57 = getelementptr inbounds [100 x i8], [100 x i8]* %5, i64 0, i64 0
%58 = call i64 (...) @getpid()
%59 = call i32 @snprintf(i8* %57, i32 100, i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.4, i64 0, i64 0), i64 %58)
%60 = getelementptr inbounds [100 x i8], [100 x i8]* %5, i64 0, i64 0
%61 = call i32 @system(i8* %60)
ret i32 0
}

LLVM IR (-O2):
@_SC_PAGESIZE = global i32 0
@.str = [10 x i8] c"/dev/zero\00"
@O_RDWR = global i32 0
@.str.1 = [8 x i8] c"open() \00"
@EXIT_FAILURE = global i32 0
@PROT_NONE = global i32 0
@MAP_SHARED = global i32 0
@MAP_FAILED = global i8* null
@.str.2 = [8 x i8] c"mmap() \00"
@.str.3 = [9 x i8] c"close() \00"
@.str.4 = [31 x i8] c"cat /proc/%ld/maps | grep zero\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@.str.5 = [12 x i8] c"mprotect() \00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = alloca [100 x i8]
%4 = getelementptr inbounds [100 x i8], [100 x i8]* %3, i64 0, i64 0
%5 = load i32, i32* @_SC_PAGESIZE
%6 = tail call i32 @sysconf(i32 %5)
%7 = load i32, i32* @O_RDWR
%8 = tail call i32 @open(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i32 %7)
%9 = icmp slt i32 %8, 0
br i1 %9, label %10, label %14
10: ; preds = %2
%11 = tail call i32 @perror(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0))
%12 = load i32, i32* @EXIT_FAILURE
%13 = tail call i32 @exit(i32 %12)
unreachable
14: ; preds = %2
%15 = load i32, i32* @PROT_NONE
%16 = load i32, i32* @MAP_SHARED
%17 = tail call i8* @mmap(i32* null, i32 %6, i32 %15, i32 %16, i32 %8, i32 0)
%18 = load i8*, i8** @MAP_FAILED
%19 = icmp eq i8* %17, %18
br i1 %19, label %20, label %24
20: ; preds = %14
%21 = tail call i32 @perror(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0))
%22 = load i32, i32* @EXIT_FAILURE
%23 = tail call i32 @exit(i32 %22)
unreachable
24: ; preds = %14
%25 = tail call i32 @close(i32 %8)
%26 = icmp eq i32 %25, -1
br i1 %26, label %27, label %31
27: ; preds = %24
%28 = tail call i32 @perror(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0))
%29 = load i32, i32* @EXIT_FAILURE
%30 = tail call i32 @exit(i32 %29)
unreachable
31: ; preds = %24
%32 = tail call i64 (...) @getpid()
%33 = call i32 @snprintf(i8* %4, i32 100, i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.4, i64 0, i64 0), i64 %32)
%34 = call i32 @system(i8* %4)
%35 = load i32, i32* @PROT_READ
%36 = load i32, i32* @PROT_WRITE
%37 = or i32 %36, %35
%38 = call i32 @mprotect(i8* %17, i32 %6, i32 %37)
%39 = icmp eq i32 %38, -1
br i1 %39, label %40, label %44
40: ; preds = %31
%41 = call i32 @perror(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.5, i64 0, i64 0))
%42 = load i32, i32* @EXIT_FAILURE
%43 = call i32 @exit(i32 %42)
unreachable
44: ; preds = %31
%45 = call i64 (...) @getpid()
%46 = call i32 @snprintf(i8* %4, i32 100, i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.4, i64 0, i64 0), i64 %45)
%47 = call i32 @system(i8* %4)
ret i32 0
}