#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int uint8_t;

/* Variables and functions */
int /*<<< orphan*/ fflush(int /*<<< orphan*/);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *);
int /*<<< orphan*/ stdout;
int main() {
  void (*func)();
  uintptr_t code_ptr = 0x80000;
  fprintf(stdout, "This should fault...\n");
  fflush(stdout);
  *(uint8_t *)code_ptr = 0xc3;
  fprintf(stdout, "We're still running. This is wrong.\n");
  fprintf(stdout, "Now try executing the code we wrote...\n");
  func = (void (*)())(uintptr_t)code_ptr;
  func();
  fprintf(stdout, "We managed to run the code. This is bad.\n");
  return 1;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x80000,-0x18(%rbp)
mov    0x2ea2(%rip),%rax
mov    (%rax),%edi
lea    0xeb9(%rip),%rsi
call   1030 <fprintf@plt>
mov    0x2e8d(%rip),%rax
mov    (%rax),%edi
call   1040 <fflush@plt>
mov    -0x18(%rbp),%rax
movl   $0xc3,(%rax)
mov    0x2e75(%rip),%rax
mov    (%rax),%edi
lea    0xea2(%rip),%rsi
call   1030 <fprintf@plt>
mov    0x2e60(%rip),%rax
mov    (%rax),%edi
lea    0xeb2(%rip),%rsi
call   1030 <fprintf@plt>
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    $0x0,%al
call   *-0x10(%rbp)
mov    0x2e3e(%rip),%rax
mov    (%rax),%edi
lea    0xeb8(%rip),%rsi
call   1030 <fprintf@plt>
mov    $0x1,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
mov    0x2eb8(%rip),%rbx
mov    (%rbx),%edi
lea    0xecf(%rip),%rsi
call   1030 <fprintf@plt>
mov    (%rbx),%edi
call   1040 <fflush@plt>
movl   $0xc3,0x80000
mov    (%rbx),%edi
lea    0xec5(%rip),%rsi
call   1030 <fprintf@plt>
mov    (%rbx),%edi
lea    0xedc(%rip),%rsi
call   1030 <fprintf@plt>
mov    $0x80000,%ecx
xor    %eax,%eax
call   *%rcx
mov    (%rbx),%edi
lea    0xeed(%rip),%rsi
call   1030 <fprintf@plt>
mov    $0x1,%eax
pop    %rbx
ret

LLVM IR (-O0):
@stdout = global i32 0
@.str = [22 x i8] c"This should fault...\0A\00"
@.str.1 = [37 x i8] c"We're still running. This is wrong.\0A\00"
@.str.2 = [40 x i8] c"Now try executing the code we wrote...\0A\00"
@.str.3 = [42 x i8] c"We managed to run the code. This is bad.\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca void (...)*
%3 = alloca i64
store i32 0, i32* %1
store i64 524288, i64* %3
%4 = load i32, i32* @stdout
%5 = call i32 @fprintf(i32 %4, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%6 = load i32, i32* @stdout
%7 = call i32 @fflush(i32 %6)
%8 = load i64, i64* %3
%9 = inttoptr i64 %8 to i32*
store i32 195, i32* %9
%10 = load i32, i32* @stdout
%11 = call i32 @fprintf(i32 %10, i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.1, i64 0, i64 0))
%12 = load i32, i32* @stdout
%13 = call i32 @fprintf(i32 %12, i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.2, i64 0, i64 0))
%14 = load i64, i64* %3
%15 = inttoptr i64 %14 to void (...)*
store void (...)* %15, void (...)** %2
%16 = load void (...)*, void (...)** %2
%17 = load i32, i32* @stdout
%18 = call i32 @fprintf(i32 %17, i8* getelementptr inbounds ([42 x i8], [42 x i8]* @.str.3, i64 0, i64 0))
ret i32 1
}

LLVM IR (-O2):
@stdout = global i32 0
@.str = [22 x i8] c"This should fault...\0A\00"
@.str.1 = [37 x i8] c"We're still running. This is wrong.\0A\00"
@.str.2 = [40 x i8] c"Now try executing the code we wrote...\0A\00"
@.str.3 = [42 x i8] c"We managed to run the code. This is bad.\0A\00"
define i32 @main() {
%1 = load i32, i32* @stdout
%2 = tail call i32 @fprintf(i32 %1, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%3 = load i32, i32* @stdout
%4 = tail call i32 @fflush(i32 %3)
store i32 195, i32* inttoptr (i64 524288 to i32*)
%5 = load i32, i32* @stdout
%6 = tail call i32 @fprintf(i32 %5, i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.1, i64 0, i64 0))
%7 = load i32, i32* @stdout
%8 = tail call i32 @fprintf(i32 %7, i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.2, i64 0, i64 0))
tail call void (...) inttoptr (i64 524288 to void (...)*)()
%9 = load i32, i32* @stdout
%10 = tail call i32 @fprintf(i32 %9, i8* getelementptr inbounds ([42 x i8], [42 x i8]* @.str.3, i64 0, i64 0))
ret i32 1
}