#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ O_RDWR;
int getppid();
int open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ send_fd(int, int);
int /*<<< orphan*/ sprintf(char *, char *, int);
int child(int sock) {
  char parent_mem[256];
  sprintf(parent_mem, "/proc/%d/mem", getppid());
  printf("[+] Opening parent mem %s in child.\n", parent_mem);
  int fd = open(parent_mem, O_RDWR);
  if (fd < 0) {
    perror("[-] open");
    return 1;
  }
  printf("[+] Sending fd %d to parent.\n", fd);
  send_fd(sock, fd);
  return 0;
}


x86 assembly (clang, -O0):
<child>:
push   %rbp
mov    %rsp,%rbp
sub    $0x120,%rsp
mov    %edi,-0x8(%rbp)
lea    -0x110(%rbp),%rax
mov    %rax,-0x120(%rbp)
mov    $0x0,%al
call   1080 <getppid@plt>
mov    -0x120(%rbp),%rdi
mov    %eax,%edx
lea    0xe6d(%rip),%rsi
call   1070 <sprintf@plt>
lea    -0x110(%rbp),%rsi
lea    0xe67(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x110(%rbp),%rdi
mov    0x2e2d(%rip),%rax
mov    (%rax),%esi
call   1050 <open@plt>
mov    %eax,-0x114(%rbp)
cmpl   $0x0,-0x114(%rbp)
jge    11ed <child+0x8d>
lea    0xe56(%rip),%rdi
call   1060 <perror@plt>
movl   $0x1,-0x4(%rbp)
jmp    1216 <child+0xb6>
mov    -0x114(%rbp),%esi
lea    0xe41(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x8(%rbp),%edi
mov    -0x114(%rbp),%esi
call   1030 <send_fd@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x120,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<child>:
push   %rbp
push   %r14
push   %rbx
sub    $0x100,%rsp
mov    %edi,%ebp
xor    %r14d,%r14d
xor    %eax,%eax
call   1080 <getppid@plt>
lea    0xe82(%rip),%rsi
mov    %rsp,%rbx
mov    %rbx,%rdi
mov    %eax,%edx
call   1070 <sprintf@plt>
lea    0xe7b(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
mov    0x2e45(%rip),%rax
mov    (%rax),%esi
mov    %rbx,%rdi
call   1050 <open@plt>
test   %eax,%eax
js     11db <child+0x7b>
mov    %eax,%ebx
lea    0xe81(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1040 <printf@plt>
mov    %ebp,%edi
mov    %ebx,%esi
call   1030 <send_fd@plt>
mov    %r14d,%eax
add    $0x100,%rsp
pop    %rbx
pop    %r14
pop    %rbp
ret
lea    0xe50(%rip),%rdi
call   1060 <perror@plt>
mov    $0x1,%r14d
jmp    11cc <child+0x6c>

LLVM IR (-O0):
@.str = [13 x i8] c"/proc/%d/mem\00"
@.str.1 = [37 x i8] c"[+] Opening parent mem %s in child.\0A\00"
@O_RDWR = global i32 0
@.str.2 = [9 x i8] c"[-] open\00"
@.str.3 = [30 x i8] c"[+] Sending fd %d to parent.\0A\00"
define i32 @child(i32 %0) {
%2 = alloca i32
%3 = alloca i32
%4 = alloca [256 x i8]
%5 = alloca i32
store i32 %0, i32* %3
%6 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 0
%7 = call i32 (...) @getppid()
%8 = call i32 @sprintf(i8* %6, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i32 %7)
%9 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 0
%10 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.1, i64 0, i64 0), i8* %9)
%11 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 0
%12 = load i32, i32* @O_RDWR
%13 = call i32 @open(i8* %11, i32 %12)
store i32 %13, i32* %5
%14 = load i32, i32* %5
%15 = icmp slt i32 %14, 0
br i1 %15, label %16, label %18
16: ; preds = %1
%17 = call i32 @perror(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.2, i64 0, i64 0))
store i32 1, i32* %2
br label %24
18: ; preds = %1
%19 = load i32, i32* %5
%20 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.3, i64 0, i64 0), i32 %19)
%21 = load i32, i32* %3
%22 = load i32, i32* %5
%23 = call i32 @send_fd(i32 %21, i32 %22)
store i32 0, i32* %2
br label %24
24: ; preds = %18, %16
%25 = load i32, i32* %2
ret i32 %25
}

LLVM IR (-O2):
@.str = [13 x i8] c"/proc/%d/mem\00"
@.str.1 = [37 x i8] c"[+] Opening parent mem %s in child.\0A\00"
@O_RDWR = global i32 0
@.str.2 = [9 x i8] c"[-] open\00"
@.str.3 = [30 x i8] c"[+] Sending fd %d to parent.\0A\00"
define i32 @child(i32 %0) {
%2 = alloca [256 x i8]
%3 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%4 = tail call i32 (...) @getppid()
%5 = call i32 @sprintf(i8* %3, i8* dereferenceable(1) getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i32 %4)
%6 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([37 x i8], [37 x i8]* @.str.1, i64 0, i64 0), i8* %3)
%7 = load i32, i32* @O_RDWR
%8 = call i32 @open(i8* %3, i32 %7)
%9 = icmp slt i32 %8, 0
br i1 %9, label %10, label %12
10: ; preds = %1
%11 = call i32 @perror(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.2, i64 0, i64 0))
br label %15
12: ; preds = %1
%13 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @.str.3, i64 0, i64 0), i32 %8)
%14 = call i32 @send_fd(i32 %0, i32 %8)
br label %15
15: ; preds = %12, %10
%16 = phi i32 [ 1, %10 ], [ 0, %12 ]
ret i32 %16
}