#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int pid_t;

/* Variables and functions */
int /*<<< orphan*/ PTRACE_CONT;
int /*<<< orphan*/ PTRACE_SINGLESTEP;
scalar_t__ WIFEXITED(int);
scalar_t__ WIFSTOPPED(int);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, ...);
scalar_t__ ptrace(int /*<<< orphan*/, int, int /*<<< orphan*/,
                  int /*<<< orphan*/);
int waitpid(int, int *, int /*<<< orphan*/);
int run_debugger(pid_t pid) {
  int status;
  int counter = 0;
  const int STEP = 4000;
  printf("debugger start...\n");
  if (0 > (pid = waitpid(pid, &status, 0))) {
    perror("waitpid");
    return -1;
  }
  while (1) {
    if (WIFEXITED(status)) {
      printf("\n[+] detect process %d exit\n", pid);
      break;
    }
    if (WIFSTOPPED(status)) {
      counter++;
      printf("[+] child process execute No.%u instruction!\n", counter);
      if (counter < STEP) {
        if (ptrace(PTRACE_SINGLESTEP, pid, 0, 0) < 0) {
          perror("ptrace PTRACE_SINGLESTEP");
          return -1;
        }
      } else {
        if (ptrace(PTRACE_CONT, pid, 0, 0) < 0) {
          perror("ptrace PTRACE_CONT");
          return -1;
        }
        printf("[+] child process continue to run!\n", counter);
      }
    }
    if (0 > (pid = waitpid(pid, &status, 0))) {
      perror("waitpid");
      return -1;
    }
  }
  printf("[+] the child process has executed %u instructions by single step\n",
         counter++);
  return 0;
}


x86 assembly (clang, -O0):
<run_debugger>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %edi,-0x8(%rbp)
movl   $0x0,-0x10(%rbp)
movl   $0xfa0,-0x14(%rbp)
lea    0xe80(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x8(%rbp),%edi
lea    -0xc(%rbp),%rsi
xor    %edx,%edx
call   1060 <waitpid@plt>
mov    %eax,%ecx
mov    %ecx,-0x8(%rbp)
xor    %eax,%eax
cmp    %ecx,%eax
jle    11bc <run_debugger+0x5c>
lea    0xe68(%rip),%rdi
call   1070 <perror@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1305 <run_debugger+0x1a5>
jmp    11c1 <run_debugger+0x61>
mov    -0xc(%rbp),%edi
call   1080 <WIFEXITED@plt>
cmp    $0x0,%rax
je     11e9 <run_debugger+0x89>
mov    -0x8(%rbp),%esi
lea    0xe3e(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
jmp    12e5 <run_debugger+0x185>
mov    -0xc(%rbp),%edi
call   1040 <WIFSTOPPED@plt>
cmp    $0x0,%rax
je     12ab <run_debugger+0x14b>
mov    -0x10(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x10(%rbp)
mov    -0x10(%rbp),%esi
lea    0xe2a(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
cmpl   $0xfa0,-0x10(%rbp)
jge    125e <run_debugger+0xfe>
mov    0x2db7(%rip),%rax
mov    (%rax),%edi
mov    -0x8(%rbp),%esi
xor    %ecx,%ecx
mov    %ecx,%edx
call   1050 <ptrace@plt>
cmp    $0x0,%rax
jge    1259 <run_debugger+0xf9>
lea    0xe1e(%rip),%rdi
call   1070 <perror@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1305 <run_debugger+0x1a5>
jmp    12a6 <run_debugger+0x146>
mov    0x2d73(%rip),%rax
mov    (%rax),%edi
mov    -0x8(%rbp),%esi
xor    %ecx,%ecx
mov    %ecx,%edx
call   1050 <ptrace@plt>
cmp    $0x0,%rax
jge    1295 <run_debugger+0x135>
lea    0xdfb(%rip),%rdi
call   1070 <perror@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1305 <run_debugger+0x1a5>
mov    -0x10(%rbp),%esi
lea    0xdf3(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
jmp    12ab <run_debugger+0x14b>
mov    -0x8(%rbp),%edi
lea    -0xc(%rbp),%rsi
xor    %edx,%edx
call   1060 <waitpid@plt>
mov    %eax,%ecx
mov    %ecx,-0x8(%rbp)
xor    %eax,%eax
cmp    %ecx,%eax
jle    12e0 <run_debugger+0x180>
lea    0xd44(%rip),%rdi
call   1070 <perror@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1305 <run_debugger+0x1a5>
jmp    11c1 <run_debugger+0x61>
mov    -0x10(%rbp),%esi
mov    %esi,%eax
add    $0x1,%eax
mov    %eax,-0x10(%rbp)
lea    0xdbf(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<run_debugger>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %edi,%ebx
lea    0xf3e(%rip),%rdi
call   1030 <puts@plt>
lea    0x4(%rsp),%rsi
mov    %ebx,%edi
xor    %edx,%edx
call   1070 <waitpid@plt>
test   %eax,%eax
js     128b <run_debugger+0x11b>
mov    %eax,%ebx
lea    0x4(%rsp),%r14
lea    0xe78(%rip),%r15
lea    0xf20(%rip),%r12
xor    %ebp,%ebp
jmp    11dc <run_debugger+0x6c>
nopl   0x0(%rax,%rax,1)
mov    %ebp,%r13d
mov    %ebx,%edi
mov    %r14,%rsi
xor    %edx,%edx
call   1070 <waitpid@plt>
mov    %eax,%ebx
mov    %r13d,%ebp
test   %eax,%eax
js     128b <run_debugger+0x11b>
mov    0x4(%rsp),%edi
call   1090 <WIFEXITED@plt>
test   %rax,%rax
jne    1256 <run_debugger+0xe6>
mov    0x4(%rsp),%edi
call   1050 <WIFSTOPPED@plt>
test   %rax,%rax
je     11c0 <run_debugger+0x50>
lea    0x1(%rbp),%r13d
mov    %r15,%rdi
mov    %r13d,%esi
xor    %eax,%eax
call   1040 <printf@plt>
cmp    $0xf9e,%ebp
jg     1230 <run_debugger+0xc0>
mov    0x2dc8(%rip),%rax
mov    (%rax),%edi
mov    %ebx,%esi
xor    %edx,%edx
xor    %ecx,%ecx
call   1060 <ptrace@plt>
test   %rax,%rax
jns    11c3 <run_debugger+0x53>
jmp    129f <run_debugger+0x12f>
nopl   0x0(%rax)
mov    0x2da1(%rip),%rax
mov    (%rax),%edi
mov    %ebx,%esi
xor    %edx,%edx
xor    %ecx,%ecx
call   1060 <ptrace@plt>
test   %rax,%rax
js     12a8 <run_debugger+0x138>
mov    %r12,%rdi
call   1030 <puts@plt>
jmp    11c3 <run_debugger+0x53>
lea    0xdab(%rip),%rdi
xor    %r14d,%r14d
mov    %ebx,%esi
xor    %eax,%eax
call   1040 <printf@plt>
lea    0xe0f(%rip),%rdi
mov    %ebp,%esi
xor    %eax,%eax
call   1040 <printf@plt>
mov    %r14d,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xd6e(%rip),%rdi
call   1080 <perror@plt>
mov    $0xffffffff,%r14d
jmp    1279 <run_debugger+0x109>
lea    0xdad(%rip),%rdi
jmp    1292 <run_debugger+0x122>
lea    0xdbd(%rip),%rdi
jmp    1292 <run_debugger+0x122>

LLVM IR (-O0):
@.str = [19 x i8] c"debugger start...\0A\00"
@.str.1 = [8 x i8] c"waitpid\00"
@.str.2 = [29 x i8] c"\0A[+] detect process %d exit\0A\00"
@.str.3 = [46 x i8] c"[+] child process execute No.%u instruction!\0A\00"
@PTRACE_SINGLESTEP = global i32 0
@.str.4 = [25 x i8] c"ptrace PTRACE_SINGLESTEP\00"
@PTRACE_CONT = global i32 0
@.str.5 = [19 x i8] c"ptrace PTRACE_CONT\00"
@.str.6 = [36 x i8] c"[+] child process continue to run!\0A\00"
@.str.7 = [67 x i8] c"[+] the child process has executed %u instructions by single step\0A\00"
define i32 @run_debugger(i32 %0) {
%2 = alloca i32
%3 = alloca i32
%4 = alloca i32
%5 = alloca i32
%6 = alloca i32
store i32 %0, i32* %3
store i32 0, i32* %5
store i32 4000, i32* %6
%7 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i64 0, i64 0))
%8 = load i32, i32* %3
%9 = call i32 @waitpid(i32 %8, i32* %4, i32 0)
store i32 %9, i32* %3
%10 = icmp sgt i32 0, %9
br i1 %10, label %11, label %13
11: ; preds = %1
%12 = call i32 @perror(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0))
store i32 -1, i32* %2
br label %62
13: ; preds = %1
br label %14
14: ; preds = %13, %57
%15 = load i32, i32* %4
%16 = call i64 @WIFEXITED(i32 %15)
%17 = icmp ne i64 %16, 0
br i1 %17, label %18, label %21
18: ; preds = %14
%19 = load i32, i32* %3
%20 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.2, i64 0, i64 0), i32 %19)
br label %58
21: ; preds = %14
%22 = load i32, i32* %4
%23 = call i64 @WIFSTOPPED(i32 %22)
%24 = icmp ne i64 %23, 0
br i1 %24, label %25, label %51
25: ; preds = %21
%26 = load i32, i32* %5
%27 = add nsw i32 %26, 1
store i32 %27, i32* %5
%28 = load i32, i32* %5
%29 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([46 x i8], [46 x i8]* @.str.3, i64 0, i64 0), i32 %28)
%30 = load i32, i32* %5
%31 = icmp slt i32 %30, 4000
br i1 %31, label %32, label %40
32: ; preds = %25
%33 = load i32, i32* @PTRACE_SINGLESTEP
%34 = load i32, i32* %3
%35 = call i64 @ptrace(i32 %33, i32 %34, i32 0, i32 0)
%36 = icmp slt i64 %35, 0
br i1 %36, label %37, label %39
37: ; preds = %32
%38 = call i32 @perror(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.4, i64 0, i64 0))
store i32 -1, i32* %2
br label %62
39: ; preds = %32
br label %50
40: ; preds = %25
%41 = load i32, i32* @PTRACE_CONT
%42 = load i32, i32* %3
%43 = call i64 @ptrace(i32 %41, i32 %42, i32 0, i32 0)
%44 = icmp slt i64 %43, 0
br i1 %44, label %45, label %47
45: ; preds = %40
%46 = call i32 @perror(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.5, i64 0, i64 0))
store i32 -1, i32* %2
br label %62
47: ; preds = %40
%48 = load i32, i32* %5
%49 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.6, i64 0, i64 0), i32 %48)
br label %50
50: ; preds = %47, %39
br label %51
51: ; preds = %50, %21
%52 = load i32, i32* %3
%53 = call i32 @waitpid(i32 %52, i32* %4, i32 0)
store i32 %53, i32* %3
%54 = icmp sgt i32 0, %53
br i1 %54, label %55, label %57
55: ; preds = %51
%56 = call i32 @perror(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0))
store i32 -1, i32* %2
br label %62
57: ; preds = %51
br label %14
58: ; preds = %18
%59 = load i32, i32* %5
%60 = add nsw i32 %59, 1
store i32 %60, i32* %5
%61 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([67 x i8], [67 x i8]* @.str.7, i64 0, i64 0), i32 %59)
store i32 0, i32* %2
br label %62
62: ; preds = %58, %55, %45, %37, %11
%63 = load i32, i32* %2
ret i32 %63
}

LLVM IR (-O2):
@.str.1 = [8 x i8] c"waitpid\00"
@.str.2 = [29 x i8] c"\0A[+] detect process %d exit\0A\00"
@.str.3 = [46 x i8] c"[+] child process execute No.%u instruction!\0A\00"
@PTRACE_SINGLESTEP = global i32 0
@.str.4 = [25 x i8] c"ptrace PTRACE_SINGLESTEP\00"
@PTRACE_CONT = global i32 0
@.str.5 = [19 x i8] c"ptrace PTRACE_CONT\00"
@.str.7 = [67 x i8] c"[+] the child process has executed %u instructions by single step\0A\00"
@str = [18 x i8] c"debugger start...\00"
@str.8 = [35 x i8] c"[+] child process continue to run!\00"
define i32 @run_debugger(i32 %0) {
%2 = alloca i32
%3 = bitcast i32* %2 to i8*
%4 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([18 x i8], [18 x i8]* @str, i64 0, i64 0))
%5 = call i32 @waitpid(i32 %0, i32* %2, i32 0)
%6 = icmp slt i32 %5, 0
br i1 %6, label %7, label %9
7: ; preds = %1
%8 = call i32 @perror(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0))
br label %46
9: ; preds = %1, %40
%10 = phi i32 [ %42, %40 ], [ %5, %1 ]
%11 = phi i32 [ %41, %40 ], [ 0, %1 ]
%12 = load i32, i32* %2
%13 = call i64 @WIFEXITED(i32 %12)
%14 = icmp eq i64 %13, 0
br i1 %14, label %18, label %15
15: ; preds = %9
%16 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @.str.2, i64 0, i64 0), i32 %10)
%17 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([67 x i8], [67 x i8]* @.str.7, i64 0, i64 0), i32 %11)
br label %46
18: ; preds = %9
%19 = load i32, i32* %2
%20 = call i64 @WIFSTOPPED(i32 %19)
%21 = icmp eq i64 %20, 0
br i1 %21, label %40, label %22
22: ; preds = %18
%23 = add nsw i32 %11, 1
%24 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([46 x i8], [46 x i8]* @.str.3, i64 0, i64 0), i32 %23)
%25 = icmp slt i32 %11, 3999
br i1 %25, label %26, label %32
26: ; preds = %22
%27 = load i32, i32* @PTRACE_SINGLESTEP
%28 = call i64 @ptrace(i32 %27, i32 %10, i32 0, i32 0)
%29 = icmp slt i64 %28, 0
br i1 %29, label %30, label %40
30: ; preds = %26
%31 = call i32 @perror(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.4, i64 0, i64 0))
br label %46
32: ; preds = %22
%33 = load i32, i32* @PTRACE_CONT
%34 = call i64 @ptrace(i32 %33, i32 %10, i32 0, i32 0)
%35 = icmp slt i64 %34, 0
br i1 %35, label %36, label %38
36: ; preds = %32
%37 = call i32 @perror(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.5, i64 0, i64 0))
br label %46
38: ; preds = %32
%39 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([35 x i8], [35 x i8]* @str.8, i64 0, i64 0))
br label %40
40: ; preds = %38, %26, %18
%41 = phi i32 [ %23, %26 ], [ %23, %38 ], [ %11, %18 ]
%42 = call i32 @waitpid(i32 %10, i32* %2, i32 0)
%43 = icmp slt i32 %42, 0
br i1 %43, label %44, label %9
44: ; preds = %40
%45 = call i32 @perror(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0))
br label %46
46: ; preds = %15, %44, %36, %30, %7
%47 = phi i32 [ -1, %7 ], [ 0, %15 ], [ -1, %30 ], [ -1, %44 ], [ -1, %36 ]
ret i32 %47
}