#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_10__ TYPE_3__;
typedef struct TYPE_9__ TYPE_1__;

/* Type definitions */
struct TYPE_10__ {
  scalar_t__ r_offset;
  int /*<<< orphan*/ r_info;
};
struct TYPE_9__ {
  int sh_size;
  scalar_t__ sh_addr;
};
typedef TYPE_1__ Elf64_Sym;
typedef TYPE_1__ Elf64_Shdr;
typedef TYPE_3__ Elf64_Rela;

/* Variables and functions */
size_t ELF64_R_SYM(int /*<<< orphan*/);
int /*<<< orphan*/ O_RDONLY;
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ SHT_DYNSYM;
int /*<<< orphan*/ _SC_PAGESIZE;
int /*<<< orphan*/ close(int);
scalar_t__ errno;
int /*<<< orphan*/ free(TYPE_1__ *);
int /*<<< orphan*/ mprotect(void *, size_t, int);
int open(char const *, int /*<<< orphan*/);
scalar_t__ section_by_name(int, char *, TYPE_1__ **);
scalar_t__ section_by_type(int, int /*<<< orphan*/, TYPE_1__ **);
scalar_t__ symbol_by_name(int, TYPE_1__ *, char const *, TYPE_1__ **, size_t *);
size_t sysconf(int /*<<< orphan*/);
void *elf_hook(char const *module_filename, void const *module_address,
               char const *name, void const *substitution) {
  static size_t pagesize;
  int descriptor;
  Elf64_Shdr *dynsym = NULL, *rel_plt = NULL, *rel_dyn = NULL;
  Elf64_Sym *symbol = NULL;
  Elf64_Rela *rel_plt_table = NULL, *rel_dyn_table = NULL;
  size_t i, name_index, rel_plt_amount, rel_dyn_amount, *name_address = NULL;
  void *original = NULL;
  if (NULL == module_address || NULL == name || NULL == substitution)
    return original;
  if (!pagesize)
    pagesize = sysconf(_SC_PAGESIZE);
  descriptor = open(module_filename, O_RDONLY);
  if (descriptor < 0)
    return original;
  if (section_by_type(descriptor, SHT_DYNSYM, &dynsym) ||
      symbol_by_name(descriptor, dynsym, name, &symbol, &name_index) ||
      section_by_name(descriptor, ".rela.plt", &rel_plt) ||
      section_by_name(descriptor, ".rela.dyn", &rel_dyn)) {
    free(dynsym);
    free(rel_plt);
    free(rel_dyn);
    free(symbol);
    close(descriptor);
    return original;
  }
  free(dynsym);
  free(symbol);
  rel_plt_table = (Elf64_Rela *)(((size_t)module_address) + rel_plt->sh_addr);
  rel_plt_amount = rel_plt->sh_size / sizeof(Elf64_Rela);
  rel_dyn_table = (Elf64_Rela *)(((size_t)module_address) + rel_dyn->sh_addr);
  rel_dyn_amount = rel_dyn->sh_size / sizeof(Elf64_Rela);
  free(rel_plt);
  free(rel_dyn);
  close(descriptor);
  for (i = 0; i < rel_plt_amount; ++i)
    if (ELF64_R_SYM(rel_plt_table[i].r_info) == name_index) {
      original = (void *)*(size_t *)(((size_t)module_address) +
                                     rel_plt_table[i].r_offset);
      *(size_t *)(((size_t)module_address) + rel_plt_table[i].r_offset) =
          (size_t)substitution;
      break;
    }
  if (original)
    return original;
  for (i = 0; i < rel_dyn_amount; ++i)
    if (ELF64_R_SYM(rel_dyn_table[i].r_info) == name_index) {
      name_address =
          (size_t *)(((size_t)module_address) + rel_dyn_table[i].r_offset);
      if (!original)
        original =
            (void *)(*name_address + (size_t)name_address + sizeof(size_t));
      mprotect(
          (void *)(((size_t)name_address) & (((size_t)-1) ^ (pagesize - 1))),
          pagesize, PROT_READ | PROT_WRITE);
      if (errno)
        return NULL;
      *name_address =
          (size_t)substitution - (size_t)name_address - sizeof(size_t);
      mprotect(
          (void *)(((size_t)name_address) & (((size_t)-1) ^ (pagesize - 1))),
          pagesize, PROT_READ | PROT_EXEC);
      if (errno) {
        *name_address =
            (size_t)original - (size_t)name_address - sizeof(size_t);
        return NULL;
      }
    }
  return original;
}


x86 assembly (clang, -O0):
<elf_hook>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
movq   $0x0,-0x38(%rbp)
movq   $0x0,-0x40(%rbp)
movq   $0x0,-0x48(%rbp)
movq   $0x0,-0x50(%rbp)
movq   $0x0,-0x58(%rbp)
movq   $0x0,-0x60(%rbp)
movq   $0x0,-0x88(%rbp)
movq   $0x0,-0x90(%rbp)
xor    %eax,%eax
cmp    -0x18(%rbp),%rax
je     1215 <elf_hook+0x85>
xor    %eax,%eax
cmp    -0x20(%rbp),%rax
je     1215 <elf_hook+0x85>
xor    %eax,%eax
cmp    -0x28(%rbp),%rax
jne    1225 <elf_hook+0x95>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    15d1 <elf_hook+0x441>
cmpq   $0x0,0x2e43(%rip)
jne    1248 <elf_hook+0xb8>
mov    0x2d96(%rip),%rax
mov    (%rax),%edi
call   10a0 <sysconf@plt>
mov    %rax,0x2e28(%rip)
mov    -0x10(%rbp),%rdi
mov    0x2d8d(%rip),%rax
mov    (%rax),%esi
call   1090 <open@plt>
mov    %eax,-0x2c(%rbp)
cmpl   $0x0,-0x2c(%rbp)
jge    1277 <elf_hook+0xe7>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    15d1 <elf_hook+0x441>
mov    -0x2c(%rbp),%edi
mov    0x2d57(%rip),%rax
mov    (%rax),%esi
lea    -0x38(%rbp),%rdx
call   10b0 <section_by_type@plt>
cmp    $0x0,%rax
jne    12f2 <elf_hook+0x162>
mov    -0x2c(%rbp),%edi
mov    -0x38(%rbp),%rsi
mov    -0x20(%rbp),%rdx
lea    -0x50(%rbp),%rcx
lea    -0x70(%rbp),%r8
call   1060 <symbol_by_name@plt>
cmp    $0x0,%rax
jne    12f2 <elf_hook+0x162>
mov    -0x2c(%rbp),%edi
lea    0xd3e(%rip),%rsi
lea    -0x40(%rbp),%rdx
call   1070 <section_by_name@plt>
cmp    $0x0,%rax
jne    12f2 <elf_hook+0x162>
mov    -0x2c(%rbp),%edi
lea    0xd2b(%rip),%rsi
lea    -0x48(%rbp),%rdx
call   1070 <section_by_name@plt>
cmp    $0x0,%rax
je     132e <elf_hook+0x19e>
mov    -0x38(%rbp),%rdi
call   1030 <free@plt>
mov    -0x40(%rbp),%rdi
call   1030 <free@plt>
mov    -0x48(%rbp),%rdi
call   1030 <free@plt>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
mov    -0x2c(%rbp),%edi
call   1040 <close@plt>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    15d1 <elf_hook+0x441>
mov    -0x38(%rbp),%rdi
call   1030 <free@plt>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
mov    -0x18(%rbp),%rax
mov    -0x40(%rbp),%rcx
add    0x8(%rcx),%rax
mov    %rax,-0x58(%rbp)
mov    -0x40(%rbp),%rax
movslq (%rax),%rax
shr    $0x4,%rax
mov    %rax,-0x78(%rbp)
mov    -0x18(%rbp),%rax
mov    -0x48(%rbp),%rcx
add    0x8(%rcx),%rax
mov    %rax,-0x60(%rbp)
mov    -0x48(%rbp),%rax
movslq (%rax),%rax
shr    $0x4,%rax
mov    %rax,-0x80(%rbp)
mov    -0x40(%rbp),%rdi
call   1030 <free@plt>
mov    -0x48(%rbp),%rdi
call   1030 <free@plt>
mov    -0x2c(%rbp),%edi
call   1040 <close@plt>
movq   $0x0,-0x68(%rbp)
mov    -0x68(%rbp),%rax
cmp    -0x78(%rbp),%rax
jae    1427 <elf_hook+0x297>
mov    -0x58(%rbp),%rax
mov    -0x68(%rbp),%rcx
shl    $0x4,%rcx
add    %rcx,%rax
mov    0x8(%rax),%edi
call   1050 <ELF64_R_SYM@plt>
cmp    -0x70(%rbp),%rax
jne    1411 <elf_hook+0x281>
mov    -0x18(%rbp),%rax
mov    -0x58(%rbp),%rcx
mov    -0x68(%rbp),%rdx
shl    $0x4,%rdx
add    %rdx,%rcx
add    (%rcx),%rax
mov    (%rax),%rax
mov    %rax,-0x90(%rbp)
mov    -0x28(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    -0x58(%rbp),%rdx
mov    -0x68(%rbp),%rsi
shl    $0x4,%rsi
add    %rsi,%rdx
add    (%rdx),%rax
mov    %rcx,(%rax)
jmp    1427 <elf_hook+0x297>
jmp    1416 <elf_hook+0x286>
mov    -0x68(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x68(%rbp)
jmp    13a0 <elf_hook+0x210>
cmpq   $0x0,-0x90(%rbp)
je     1445 <elf_hook+0x2b5>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    15d1 <elf_hook+0x441>
movq   $0x0,-0x68(%rbp)
mov    -0x68(%rbp),%rax
cmp    -0x80(%rbp),%rax
jae    15c6 <elf_hook+0x436>
mov    -0x60(%rbp),%rax
mov    -0x68(%rbp),%rcx
shl    $0x4,%rcx
add    %rcx,%rax
mov    0x8(%rax),%edi
call   1050 <ELF64_R_SYM@plt>
cmp    -0x70(%rbp),%rax
jne    15b0 <elf_hook+0x420>
mov    -0x18(%rbp),%rax
mov    -0x60(%rbp),%rcx
mov    -0x68(%rbp),%rdx
shl    $0x4,%rdx
add    %rdx,%rcx
add    (%rcx),%rax
mov    %rax,-0x88(%rbp)
cmpq   $0x0,-0x90(%rbp)
jne    14c6 <elf_hook+0x336>
mov    -0x88(%rbp),%rax
mov    (%rax),%rax
mov    -0x88(%rbp),%rcx
add    %rcx,%rax
add    $0x8,%rax
mov    %rax,-0x90(%rbp)
mov    -0x88(%rbp),%rdi
mov    0x2b9c(%rip),%rax
sub    $0x1,%rax
xor    $0xffffffffffffffff,%rax
and    %rax,%rdi
mov    0x2b8a(%rip),%rsi
mov    0x2b0b(%rip),%rax
mov    (%rax),%edx
mov    0x2aba(%rip),%rax
or     (%rax),%edx
call   1080 <mprotect@plt>
mov    0x2ab4(%rip),%rax
cmpq   $0x0,(%rax)
je     151b <elf_hook+0x38b>
movq   $0x0,-0x8(%rbp)
jmp    15d1 <elf_hook+0x441>
mov    -0x28(%rbp),%rcx
mov    -0x88(%rbp),%rax
sub    %rax,%rcx
sub    $0x8,%rcx
mov    -0x88(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x88(%rbp),%rdi
mov    0x2b2b(%rip),%rax
sub    $0x1,%rax
xor    $0xffffffffffffffff,%rax
and    %rax,%rdi
mov    0x2b19(%rip),%rsi
mov    0x2a9a(%rip),%rax
mov    (%rax),%edx
mov    0x2a61(%rip),%rax
or     (%rax),%edx
call   1080 <mprotect@plt>
mov    0x2a43(%rip),%rax
cmpq   $0x0,(%rax)
je     15ab <elf_hook+0x41b>
mov    -0x90(%rbp),%rcx
mov    -0x88(%rbp),%rax
sub    %rax,%rcx
sub    $0x8,%rcx
mov    -0x88(%rbp),%rax
mov    %rcx,(%rax)
movq   $0x0,-0x8(%rbp)
jmp    15d1 <elf_hook+0x441>
jmp    15b0 <elf_hook+0x420>
jmp    15b5 <elf_hook+0x425>
mov    -0x68(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x68(%rbp)
jmp    144d <elf_hook+0x2bd>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x90,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<elf_hook>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x38,%rsp
movq   $0x0,0x10(%rsp)
movq   $0x0,0x28(%rsp)
movq   $0x0,0x8(%rsp)
movq   $0x0,0x20(%rsp)
xor    %r12d,%r12d
test   %rsi,%rsi
je     12c0 <elf_hook+0x130>
mov    %rdx,%rbx
test   %rdx,%rdx
je     12c0 <elf_hook+0x130>
mov    %rcx,%r14
test   %rcx,%rcx
je     12c0 <elf_hook+0x130>
mov    %rsi,%r15
mov    %rdi,%rbp
cmpq   $0x0,0x2e7c(%rip)
jne    120b <elf_hook+0x7b>
mov    0x2dd3(%rip),%rax
mov    (%rax),%edi
call   10a0 <sysconf@plt>
mov    %rax,0x2e65(%rip)
mov    0x2dce(%rip),%rax
mov    (%rax),%esi
mov    %rbp,%rdi
call   1090 <open@plt>
test   %eax,%eax
js     12bd <elf_hook+0x12d>
mov    %eax,%ebp
mov    0x2dab(%rip),%rax
mov    (%rax),%esi
lea    0x10(%rsp),%rdx
mov    %ebp,%edi
call   10b0 <section_by_type@plt>
test   %rax,%rax
jne    128e <elf_hook+0xfe>
mov    0x10(%rsp),%rsi
lea    0x20(%rsp),%rcx
lea    0x30(%rsp),%r8
mov    %ebp,%edi
mov    %rbx,%rdx
call   1060 <symbol_by_name@plt>
test   %rax,%rax
jne    128e <elf_hook+0xfe>
lea    0xd9b(%rip),%rsi
lea    0x28(%rsp),%rdx
mov    %ebp,%edi
call   1070 <section_by_name@plt>
test   %rax,%rax
jne    128e <elf_hook+0xfe>
lea    0xd8d(%rip),%rsi
lea    0x8(%rsp),%rdx
mov    %ebp,%edi
call   1070 <section_by_name@plt>
test   %rax,%rax
je     12d2 <elf_hook+0x142>
mov    0x10(%rsp),%rdi
call   1030 <free@plt>
mov    0x28(%rsp),%rdi
call   1030 <free@plt>
mov    0x8(%rsp),%rdi
call   1030 <free@plt>
mov    0x20(%rsp),%rdi
call   1030 <free@plt>
mov    %ebp,%edi
call   1040 <close@plt>
xor    %r12d,%r12d
mov    %r12,%rax
add    $0x38,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x10(%rsp),%rdi
call   1030 <free@plt>
mov    0x20(%rsp),%rdi
call   1030 <free@plt>
mov    0x28(%rsp),%rdi
mov    0x8(%rdi),%rbx
add    %r15,%rbx
movslq (%rdi),%r12
mov    0x8(%rsp),%rax
mov    0x8(%rax),%r13
add    %r15,%r13
movslq (%rax),%rax
mov    %rax,0x18(%rsp)
call   1030 <free@plt>
mov    0x8(%rsp),%rdi
call   1030 <free@plt>
mov    %ebp,%edi
call   1040 <close@plt>
cmp    $0x10,%r12
jb     1369 <elf_hook+0x1d9>
shr    $0x4,%r12
cmp    $0x2,%r12
mov    $0x1,%ebp
cmovae %r12,%rbp
add    $0x8,%rbx
mov    (%rbx),%edi
call   1050 <ELF64_R_SYM@plt>
cmp    0x30(%rsp),%rax
je     1354 <elf_hook+0x1c4>
add    $0x10,%rbx
add    $0xffffffffffffffff,%rbp
jne    133a <elf_hook+0x1aa>
jmp    1369 <elf_hook+0x1d9>
mov    -0x8(%rbx),%rax
mov    (%rax,%r15,1),%r12
mov    %r14,(%rax,%r15,1)
test   %r12,%r12
jne    12c0 <elf_hook+0x130>
mov    0x18(%rsp),%rax
cmp    $0x10,%eax
jb     12bd <elf_hook+0x12d>
shr    $0x4,%rax
add    $0xfffffffffffffff8,%r14
cmp    $0x2,%rax
mov    $0x1,%ebp
cmovae %rax,%rbp
add    $0x8,%r13
xor    %r12d,%r12d
jmp    13a3 <elf_hook+0x213>
add    $0x10,%r13
add    $0xffffffffffffffff,%rbp
je     12c0 <elf_hook+0x130>
mov    0x0(%r13),%edi
call   1050 <ELF64_R_SYM@plt>
cmp    0x30(%rsp),%rax
jne    1395 <elf_hook+0x205>
mov    %r13,0x18(%rsp)
mov    -0x8(%r13),%rbx
add    %r15,%rbx
test   %r12,%r12
jne    13cf <elf_hook+0x23f>
mov    (%rbx),%rax
lea    (%rbx,%rax,1),%r12
add    $0x8,%r12
mov    0x2c9a(%rip),%rsi
mov    %rsi,%rdi
neg    %rdi
and    %rbx,%rdi
mov    0x2bca(%rip),%rax
mov    (%rax),%edx
mov    0x2c09(%rip),%r13
or     0x0(%r13),%edx
call   1080 <mprotect@plt>
mov    0x2bb9(%rip),%rax
cmpq   $0x0,(%rax)
jne    12bd <elf_hook+0x12d>
mov    %r14,%rax
sub    %rbx,%rax
mov    %rax,(%rbx)
mov    0x2c57(%rip),%rsi
mov    %rsi,%rdi
neg    %rdi
and    %rbx,%rdi
mov    0x2b9f(%rip),%rax
mov    (%rax),%edx
or     0x0(%r13),%edx
call   1080 <mprotect@plt>
mov    0x2b7d(%rip),%rax
cmpq   $0x0,(%rax)
jne    144b <elf_hook+0x2bb>
mov    0x18(%rsp),%r13
jmp    1395 <elf_hook+0x205>
sub    %rbx,%r12
add    $0xfffffffffffffff8,%r12
mov    %r12,(%rbx)
jmp    12bd <elf_hook+0x12d>

LLVM IR (-O0):
%struct.TYPE_9__ = type { i32, i64 }
%struct.TYPE_10__ = type { i64, i32 }
@elf_hook.pagesize = internal global i64 0
@_SC_PAGESIZE = global i32 0
@O_RDONLY = global i32 0
@SHT_DYNSYM = global i32 0
@.str = [10 x i8] c".rela.plt\00"
@.str.1 = [10 x i8] c".rela.dyn\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@errno = global i64 0
@PROT_EXEC = global i32 0
define i8* @elf_hook(i8* %0, i8* %1, i8* %2, i8* %3) {
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i32
%11 = alloca %struct.TYPE_9__*
%12 = alloca %struct.TYPE_9__*
%13 = alloca %struct.TYPE_9__*
%14 = alloca %struct.TYPE_9__*
%15 = alloca %struct.TYPE_10__*
%16 = alloca %struct.TYPE_10__*
%17 = alloca i64
%18 = alloca i64
%19 = alloca i64
%20 = alloca i64
%21 = alloca i64*
%22 = alloca i8*
store i8* %0, i8** %6
store i8* %1, i8** %7
store i8* %2, i8** %8
store i8* %3, i8** %9
store %struct.TYPE_9__* null, %struct.TYPE_9__** %11
store %struct.TYPE_9__* null, %struct.TYPE_9__** %12
store %struct.TYPE_9__* null, %struct.TYPE_9__** %13
store %struct.TYPE_9__* null, %struct.TYPE_9__** %14
store %struct.TYPE_10__* null, %struct.TYPE_10__** %15
store %struct.TYPE_10__* null, %struct.TYPE_10__** %16
store i64* null, i64** %21
store i8* null, i8** %22
%23 = load i8*, i8** %7
%24 = icmp eq i8* null, %23
br i1 %24, label %31, label %25
25: ; preds = %4
%26 = load i8*, i8** %8
%27 = icmp eq i8* null, %26
br i1 %27, label %31, label %28
28: ; preds = %25
%29 = load i8*, i8** %9
%30 = icmp eq i8* null, %29
br i1 %30, label %31, label %33
31: ; preds = %28, %25, %4
%32 = load i8*, i8** %22
store i8* %32, i8** %5
br label %245
33: ; preds = %28
%34 = load i64, i64* @elf_hook.pagesize
%35 = icmp ne i64 %34, 0
br i1 %35, label %39, label %36
36: ; preds = %33
%37 = load i32, i32* @_SC_PAGESIZE
%38 = call i64 @sysconf(i32 %37)
store i64 %38, i64* @elf_hook.pagesize
br label %39
39: ; preds = %36, %33
%40 = load i8*, i8** %6
%41 = load i32, i32* @O_RDONLY
%42 = call i32 @open(i8* %40, i32 %41)
store i32 %42, i32* %10
%43 = load i32, i32* %10
%44 = icmp slt i32 %43, 0
br i1 %44, label %45, label %47
45: ; preds = %39
%46 = load i8*, i8** %22
store i8* %46, i8** %5
br label %245
47: ; preds = %39
%48 = load i32, i32* %10
%49 = load i32, i32* @SHT_DYNSYM
%50 = call i64 @section_by_type(i32 %48, i32 %49, %struct.TYPE_9__** %11)
%51 = icmp ne i64 %50, 0
br i1 %51, label %66, label %52
52: ; preds = %47
%53 = load i32, i32* %10
%54 = load %struct.TYPE_9__*, %struct.TYPE_9__** %11
%55 = load i8*, i8** %8
%56 = call i64 @symbol_by_name(i32 %53, %struct.TYPE_9__* %54, i8* %55, %struct.TYPE_9__** %14, i64* %18)
%57 = icmp ne i64 %56, 0
br i1 %57, label %66, label %58
58: ; preds = %52
%59 = load i32, i32* %10
%60 = call i64 @section_by_name(i32 %59, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), %struct.TYPE_9__** %12)
%61 = icmp ne i64 %60, 0
br i1 %61, label %66, label %62
62: ; preds = %58
%63 = load i32, i32* %10
%64 = call i64 @section_by_name(i32 %63, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0), %struct.TYPE_9__** %13)
%65 = icmp ne i64 %64, 0
br i1 %65, label %66, label %78
66: ; preds = %62, %58, %52, %47
%67 = load %struct.TYPE_9__*, %struct.TYPE_9__** %11
%68 = call i32 @free(%struct.TYPE_9__* %67)
%69 = load %struct.TYPE_9__*, %struct.TYPE_9__** %12
%70 = call i32 @free(%struct.TYPE_9__* %69)
%71 = load %struct.TYPE_9__*, %struct.TYPE_9__** %13
%72 = call i32 @free(%struct.TYPE_9__* %71)
%73 = load %struct.TYPE_9__*, %struct.TYPE_9__** %14
%74 = call i32 @free(%struct.TYPE_9__* %73)
%75 = load i32, i32* %10
%76 = call i32 @close(i32 %75)
%77 = load i8*, i8** %22
store i8* %77, i8** %5
br label %245
78: ; preds = %62
%79 = load %struct.TYPE_9__*, %struct.TYPE_9__** %11
%80 = call i32 @free(%struct.TYPE_9__* %79)
%81 = load %struct.TYPE_9__*, %struct.TYPE_9__** %14
%82 = call i32 @free(%struct.TYPE_9__* %81)
%83 = load i8*, i8** %7
%84 = ptrtoint i8* %83 to i64
%85 = load %struct.TYPE_9__*, %struct.TYPE_9__** %12
%86 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %85, i32 0, i32 1
%87 = load i64, i64* %86
%88 = add i64 %84, %87
%89 = inttoptr i64 %88 to %struct.TYPE_10__*
store %struct.TYPE_10__* %89, %struct.TYPE_10__** %15
%90 = load %struct.TYPE_9__*, %struct.TYPE_9__** %12
%91 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %90, i32 0, i32 0
%92 = load i32, i32* %91
%93 = sext i32 %92 to i64
%94 = udiv i64 %93, 16
store i64 %94, i64* %19
%95 = load i8*, i8** %7
%96 = ptrtoint i8* %95 to i64
%97 = load %struct.TYPE_9__*, %struct.TYPE_9__** %13
%98 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %97, i32 0, i32 1
%99 = load i64, i64* %98
%100 = add i64 %96, %99
%101 = inttoptr i64 %100 to %struct.TYPE_10__*
store %struct.TYPE_10__* %101, %struct.TYPE_10__** %16
%102 = load %struct.TYPE_9__*, %struct.TYPE_9__** %13
%103 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %102, i32 0, i32 0
%104 = load i32, i32* %103
%105 = sext i32 %104 to i64
%106 = udiv i64 %105, 16
store i64 %106, i64* %20
%107 = load %struct.TYPE_9__*, %struct.TYPE_9__** %12
%108 = call i32 @free(%struct.TYPE_9__* %107)
%109 = load %struct.TYPE_9__*, %struct.TYPE_9__** %13
%110 = call i32 @free(%struct.TYPE_9__* %109)
%111 = load i32, i32* %10
%112 = call i32 @close(i32 %111)
store i64 0, i64* %17
br label %113
113: ; preds = %150, %78
%114 = load i64, i64* %17
%115 = load i64, i64* %19
%116 = icmp ult i64 %114, %115
br i1 %116, label %117, label %153
117: ; preds = %113
%118 = load %struct.TYPE_10__*, %struct.TYPE_10__** %15
%119 = load i64, i64* %17
%120 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %118, i64 %119
%121 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %120, i32 0, i32 1
%122 = load i32, i32* %121
%123 = call i64 @ELF64_R_SYM(i32 %122)
%124 = load i64, i64* %18
%125 = icmp eq i64 %123, %124
br i1 %125, label %126, label %149
126: ; preds = %117
%127 = load i8*, i8** %7
%128 = ptrtoint i8* %127 to i64
%129 = load %struct.TYPE_10__*, %struct.TYPE_10__** %15
%130 = load i64, i64* %17
%131 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %129, i64 %130
%132 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %131, i32 0, i32 0
%133 = load i64, i64* %132
%134 = add i64 %128, %133
%135 = inttoptr i64 %134 to i64*
%136 = load i64, i64* %135
%137 = inttoptr i64 %136 to i8*
store i8* %137, i8** %22
%138 = load i8*, i8** %9
%139 = ptrtoint i8* %138 to i64
%140 = load i8*, i8** %7
%141 = ptrtoint i8* %140 to i64
%142 = load %struct.TYPE_10__*, %struct.TYPE_10__** %15
%143 = load i64, i64* %17
%144 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %142, i64 %143
%145 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %144, i32 0, i32 0
%146 = load i64, i64* %145
%147 = add i64 %141, %146
%148 = inttoptr i64 %147 to i64*
store i64 %139, i64* %148
br label %153
149: ; preds = %117
br label %150
150: ; preds = %149
%151 = load i64, i64* %17
%152 = add i64 %151, 1
store i64 %152, i64* %17
br label %113
153: ; preds = %126, %113
%154 = load i8*, i8** %22
%155 = icmp ne i8* %154, null
br i1 %155, label %156, label %158
156: ; preds = %153
%157 = load i8*, i8** %22
store i8* %157, i8** %5
br label %245
158: ; preds = %153
store i64 0, i64* %17
br label %159
159: ; preds = %240, %158
%160 = load i64, i64* %17
%161 = load i64, i64* %20
%162 = icmp ult i64 %160, %161
br i1 %162, label %163, label %243
163: ; preds = %159
%164 = load %struct.TYPE_10__*, %struct.TYPE_10__** %16
%165 = load i64, i64* %17
%166 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %164, i64 %165
%167 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %166, i32 0, i32 1
%168 = load i32, i32* %167
%169 = call i64 @ELF64_R_SYM(i32 %168)
%170 = load i64, i64* %18
%171 = icmp eq i64 %169, %170
br i1 %171, label %172, label %239
172: ; preds = %163
%173 = load i8*, i8** %7
%174 = ptrtoint i8* %173 to i64
%175 = load %struct.TYPE_10__*, %struct.TYPE_10__** %16
%176 = load i64, i64* %17
%177 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %175, i64 %176
%178 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %177, i32 0, i32 0
%179 = load i64, i64* %178
%180 = add i64 %174, %179
%181 = inttoptr i64 %180 to i64*
store i64* %181, i64** %21
%182 = load i8*, i8** %22
%183 = icmp ne i8* %182, null
br i1 %183, label %192, label %184
184: ; preds = %172
%185 = load i64*, i64** %21
%186 = load i64, i64* %185
%187 = load i64*, i64** %21
%188 = ptrtoint i64* %187 to i64
%189 = add i64 %186, %188
%190 = add i64 %189, 8
%191 = inttoptr i64 %190 to i8*
store i8* %191, i8** %22
br label %192
192: ; preds = %184, %172
%193 = load i64*, i64** %21
%194 = ptrtoint i64* %193 to i64
%195 = load i64, i64* @elf_hook.pagesize
%196 = sub i64 %195, 1
%197 = xor i64 -1, %196
%198 = and i64 %194, %197
%199 = inttoptr i64 %198 to i8*
%200 = load i64, i64* @elf_hook.pagesize
%201 = load i32, i32* @PROT_READ
%202 = load i32, i32* @PROT_WRITE
%203 = or i32 %201, %202
%204 = call i32 @mprotect(i8* %199, i64 %200, i32 %203)
%205 = load i64, i64* @errno
%206 = icmp ne i64 %205, 0
br i1 %206, label %207, label %208
207: ; preds = %192
store i8* null, i8** %5
br label %245
208: ; preds = %192
%209 = load i8*, i8** %9
%210 = ptrtoint i8* %209 to i64
%211 = load i64*, i64** %21
%212 = ptrtoint i64* %211 to i64
%213 = sub i64 %210, %212
%214 = sub i64 %213, 8
%215 = load i64*, i64** %21
store i64 %214, i64* %215
%216 = load i64*, i64** %21
%217 = ptrtoint i64* %216 to i64
%218 = load i64, i64* @elf_hook.pagesize
%219 = sub i64 %218, 1
%220 = xor i64 -1, %219
%221 = and i64 %217, %220
%222 = inttoptr i64 %221 to i8*
%223 = load i64, i64* @elf_hook.pagesize
%224 = load i32, i32* @PROT_READ
%225 = load i32, i32* @PROT_EXEC
%226 = or i32 %224, %225
%227 = call i32 @mprotect(i8* %222, i64 %223, i32 %226)
%228 = load i64, i64* @errno
%229 = icmp ne i64 %228, 0
br i1 %229, label %230, label %238
230: ; preds = %208
%231 = load i8*, i8** %22
%232 = ptrtoint i8* %231 to i64
%233 = load i64*, i64** %21
%234 = ptrtoint i64* %233 to i64
%235 = sub i64 %232, %234
%236 = sub i64 %235, 8
%237 = load i64*, i64** %21
store i64 %236, i64* %237
store i8* null, i8** %5
br label %245
238: ; preds = %208
br label %239
239: ; preds = %238, %163
br label %240
240: ; preds = %239
%241 = load i64, i64* %17
%242 = add i64 %241, 1
store i64 %242, i64* %17
br label %159
243: ; preds = %159
%244 = load i8*, i8** %22
store i8* %244, i8** %5
br label %245
245: ; preds = %243, %230, %207, %156, %66, %45, %31
%246 = load i8*, i8** %5
ret i8* %246
}

LLVM IR (-O2):
%struct.TYPE_9__ = type { i32, i64 }
%struct.TYPE_10__ = type { i64, i32 }
@elf_hook.pagesize = internal unnamed_addr global i64 0
@_SC_PAGESIZE = global i32 0
@O_RDONLY = global i32 0
@SHT_DYNSYM = global i32 0
@.str = [10 x i8] c".rela.plt\00"
@.str.1 = [10 x i8] c".rela.dyn\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@errno = global i64 0
@PROT_EXEC = global i32 0
define i8* @elf_hook(i8* nocapture %0, i8* %1, i8* %2, i8* %3) {
%5 = alloca %struct.TYPE_9__*
%6 = alloca %struct.TYPE_9__*
%7 = alloca %struct.TYPE_9__*
%8 = alloca %struct.TYPE_9__*
%9 = alloca i64
%10 = bitcast %struct.TYPE_9__** %5 to i8*
store %struct.TYPE_9__* null, %struct.TYPE_9__** %5
%11 = bitcast %struct.TYPE_9__** %6 to i8*
store %struct.TYPE_9__* null, %struct.TYPE_9__** %6
%12 = bitcast %struct.TYPE_9__** %7 to i8*
store %struct.TYPE_9__* null, %struct.TYPE_9__** %7
%13 = bitcast %struct.TYPE_9__** %8 to i8*
store %struct.TYPE_9__* null, %struct.TYPE_9__** %8
%14 = bitcast i64* %9 to i8*
%15 = icmp eq i8* %1, null
%16 = icmp eq i8* %2, null
%17 = or i1 %15, %16
%18 = icmp eq i8* %3, null
%19 = or i1 %17, %18
br i1 %19, label %162, label %20
20: ; preds = %4
%21 = load i64, i64* @elf_hook.pagesize
%22 = icmp eq i64 %21, 0
br i1 %22, label %23, label %26
23: ; preds = %20
%24 = load i32, i32* @_SC_PAGESIZE
%25 = tail call i64 @sysconf(i32 %24)
store i64 %25, i64* @elf_hook.pagesize
br label %26
26: ; preds = %23, %20
%27 = load i32, i32* @O_RDONLY
%28 = tail call i32 @open(i8* %0, i32 %27)
%29 = icmp slt i32 %28, 0
br i1 %29, label %162, label %30
30: ; preds = %26
%31 = load i32, i32* @SHT_DYNSYM
%32 = call i64 @section_by_type(i32 %28, i32 %31, %struct.TYPE_9__** %5)
%33 = icmp eq i64 %32, 0
br i1 %33, label %34, label %44
34: ; preds = %30
%35 = load %struct.TYPE_9__*, %struct.TYPE_9__** %5
%36 = call i64 @symbol_by_name(i32 %28, %struct.TYPE_9__* %35, i8* %2, %struct.TYPE_9__** %8, i64* %9)
%37 = icmp eq i64 %36, 0
br i1 %37, label %38, label %44
38: ; preds = %34
%39 = call i64 @section_by_name(i32 %28, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), %struct.TYPE_9__** %6)
%40 = icmp eq i64 %39, 0
br i1 %40, label %41, label %44
41: ; preds = %38
%42 = call i64 @section_by_name(i32 %28, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0), %struct.TYPE_9__** %7)
%43 = icmp eq i64 %42, 0
br i1 %43, label %54, label %44
44: ; preds = %41, %38, %34, %30
%45 = load %struct.TYPE_9__*, %struct.TYPE_9__** %5
%46 = call i32 @free(%struct.TYPE_9__* %45)
%47 = load %struct.TYPE_9__*, %struct.TYPE_9__** %6
%48 = call i32 @free(%struct.TYPE_9__* %47)
%49 = load %struct.TYPE_9__*, %struct.TYPE_9__** %7
%50 = call i32 @free(%struct.TYPE_9__* %49)
%51 = load %struct.TYPE_9__*, %struct.TYPE_9__** %8
%52 = call i32 @free(%struct.TYPE_9__* %51)
%53 = call i32 @close(i32 %28)
br label %162
54: ; preds = %41
%55 = load %struct.TYPE_9__*, %struct.TYPE_9__** %5
%56 = call i32 @free(%struct.TYPE_9__* %55)
%57 = load %struct.TYPE_9__*, %struct.TYPE_9__** %8
%58 = call i32 @free(%struct.TYPE_9__* %57)
%59 = ptrtoint i8* %1 to i64
%60 = load %struct.TYPE_9__*, %struct.TYPE_9__** %6
%61 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %60, i64 0, i32 1
%62 = load i64, i64* %61
%63 = add i64 %62, %59
%64 = inttoptr i64 %63 to %struct.TYPE_10__*
%65 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %60, i64 0, i32 0
%66 = load i32, i32* %65
%67 = load %struct.TYPE_9__*, %struct.TYPE_9__** %7
%68 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %67, i64 0, i32 1
%69 = load i64, i64* %68
%70 = add i64 %69, %59
%71 = inttoptr i64 %70 to %struct.TYPE_10__*
%72 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %67, i64 0, i32 0
%73 = load i32, i32* %72
%74 = sext i32 %73 to i64
%75 = lshr i64 %74, 4
%76 = call i32 @free(%struct.TYPE_9__* %60)
%77 = load %struct.TYPE_9__*, %struct.TYPE_9__** %7
%78 = call i32 @free(%struct.TYPE_9__* %77)
%79 = call i32 @close(i32 %28)
%80 = icmp ult i32 %66, 16
br i1 %80, label %104, label %81
81: ; preds = %54
%82 = sext i32 %66 to i64
%83 = lshr i64 %82, 4
%84 = call i64 @llvm.umax.i64(i64 %83, i64 1)
br label %85
85: ; preds = %81, %92
%86 = phi i64 [ %93, %92 ], [ 0, %81 ]
%87 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %64, i64 %86, i32 1
%88 = load i32, i32* %87
%89 = call i64 @ELF64_R_SYM(i32 %88)
%90 = load i64, i64* %9
%91 = icmp eq i64 %89, %90
br i1 %91, label %95, label %92
92: ; preds = %85
%93 = add nuw nsw i64 %86, 1
%94 = icmp eq i64 %93, %84
br i1 %94, label %104, label %85
95: ; preds = %85
%96 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %64, i64 %86, i32 0
%97 = load i64, i64* %96
%98 = add i64 %97, %59
%99 = inttoptr i64 %98 to i64*
%100 = load i64, i64* %99
%101 = inttoptr i64 %100 to i8*
%102 = ptrtoint i8* %3 to i64
store i64 %102, i64* %99
%103 = icmp eq i64 %100, 0
br i1 %103, label %104, label %162
104: ; preds = %92, %54, %95
%105 = icmp ult i32 %73, 16
br i1 %105, label %162, label %106
106: ; preds = %104
%107 = ptrtoint i8* %3 to i64
%108 = add i64 %107, -8
%109 = call i64 @llvm.umax.i64(i64 %75, i64 1)
br label %110
110: ; preds = %106, %158
%111 = phi i8* [ null, %106 ], [ %159, %158 ]
%112 = phi i64 [ 0, %106 ], [ %160, %158 ]
%113 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %71, i64 %112, i32 1
%114 = load i32, i32* %113
%115 = call i64 @ELF64_R_SYM(i32 %114)
%116 = load i64, i64* %9
%117 = icmp eq i64 %115, %116
br i1 %117, label %118, label %158
118: ; preds = %110
%119 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %71, i64 %112, i32 0
%120 = load i64, i64* %119
%121 = add i64 %120, %59
%122 = inttoptr i64 %121 to i64*
%123 = icmp eq i8* %111, null
br i1 %123, label %124, label %129
124: ; preds = %118
%125 = load i64, i64* %122
%126 = add i64 %121, 8
%127 = add i64 %126, %125
%128 = inttoptr i64 %127 to i8*
br label %129
129: ; preds = %124, %118
%130 = phi i8* [ %111, %118 ], [ %128, %124 ]
%131 = load i64, i64* @elf_hook.pagesize
%132 = sub i64 0, %131
%133 = and i64 %121, %132
%134 = inttoptr i64 %133 to i8*
%135 = load i32, i32* @PROT_READ
%136 = load i32, i32* @PROT_WRITE
%137 = or i32 %136, %135
%138 = call i32 @mprotect(i8* %134, i64 %131, i32 %137)
%139 = load i64, i64* @errno
%140 = icmp eq i64 %139, 0
br i1 %140, label %141, label %162
141: ; preds = %129
%142 = sub i64 %108, %121
store i64 %142, i64* %122
%143 = load i64, i64* @elf_hook.pagesize
%144 = sub i64 0, %143
%145 = and i64 %121, %144
%146 = inttoptr i64 %145 to i8*
%147 = load i32, i32* @PROT_READ
%148 = load i32, i32* @PROT_EXEC
%149 = or i32 %148, %147
%150 = call i32 @mprotect(i8* %146, i64 %143, i32 %149)
%151 = load i64, i64* @errno
%152 = icmp eq i64 %151, 0
br i1 %152, label %158, label %153
153: ; preds = %141
%154 = inttoptr i64 %121 to i64*
%155 = ptrtoint i8* %130 to i64
%156 = sub i64 -8, %121
%157 = add i64 %156, %155
store i64 %157, i64* %154
br label %162
158: ; preds = %110, %141
%159 = phi i8* [ %130, %141 ], [ %111, %110 ]
%160 = add nuw nsw i64 %112, 1
%161 = icmp eq i64 %160, %109
br i1 %161, label %162, label %110
162: ; preds = %129, %158, %104, %95, %26, %4, %153, %44
%163 = phi i8* [ null, %44 ], [ null, %153 ], [ null, %4 ], [ null, %26 ], [ %101, %95 ], [ null, %104 ], [ null, %129 ], [ %159, %158 ]
ret i8* %163
}