char *bar4(void *_printk, int a, char *c) {
  void (*ptr)(const char *fmt, ...);
  ptr = _printk;
  ptr("The attacking code just called printk! : "
      "With parameters passing \n");
  ptr(c);
  ptr("%d\n", a);
  void *addr_ptrk = (void *)(0xffffffff8171aab1);
  void (*ptr2)(const char *fmt, ...);
  ptr2 = addr_ptrk;
  ptr("Now test printk:\n");
  ptr2("Try to call printk without passed as a funtion pointer\n");
  ptr2("%d\n", a);
  void *(*kmalloc)(int size, int flags);
  kmalloc = (void *)(0xffffffff811a26e0);
  char *test_buf = kmalloc(1024, 0);
  test_buf[0] = 'a';
  test_buf[1] = 'b';
  test_buf[2] = '\0';
  ptr2(test_buf);
  ptr2("\n");
  return "Hello World!";
}


x86 assembly (clang, -O0):
<bar4>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x8(%rbp)
mov    %esi,-0xc(%rbp)
mov    %rdx,-0x18(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0x20(%rbp)
lea    0xede(%rip),%rdi
mov    $0x0,%al
call   *-0x20(%rbp)
mov    -0x20(%rbp),%rcx
mov    -0x18(%rbp),%rdi
mov    $0x0,%al
call   *%rcx
mov    -0x20(%rbp),%rcx
mov    -0xc(%rbp),%esi
lea    0xf02(%rip),%rdi
mov    $0x0,%al
call   *%rcx
mov    $0xffffffff8171aab1,%rax
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    %rax,-0x30(%rbp)
lea    0xee8(%rip),%rdi
mov    $0x0,%al
call   *-0x20(%rbp)
lea    0xeee(%rip),%rdi
mov    $0x0,%al
call   *-0x30(%rbp)
mov    -0x30(%rbp),%rcx
mov    -0xc(%rbp),%esi
lea    0xec5(%rip),%rdi
mov    $0x0,%al
call   *%rcx
mov    $0xffffffff811a26e0,%rax
mov    %rax,-0x38(%rbp)
mov    $0x400,%edi
xor    %esi,%esi
call   *-0x38(%rbp)
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rax
movb   $0x61,(%rax)
mov    -0x40(%rbp),%rax
movb   $0x62,0x1(%rax)
mov    -0x40(%rbp),%rax
movb   $0x0,0x2(%rax)
mov    -0x30(%rbp),%rcx
mov    -0x40(%rbp),%rdi
mov    $0x0,%al
call   *%rcx
lea    0xe7c(%rip),%rdi
mov    $0x0,%al
call   *-0x30(%rbp)
lea    0xec0(%rip),%rax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<bar4>:
push   %rbp
push   %r14
push   %rbx
mov    %rdx,%rbx
mov    %esi,%r14d
mov    %rdi,%rbp
lea    0xeec(%rip),%rdi
xor    %eax,%eax
call   *%rbp
mov    %rbx,%rdi
xor    %eax,%eax
call   *%rbp
lea    0xf1d(%rip),%rbx
mov    %rbx,%rdi
mov    %r14d,%esi
xor    %eax,%eax
call   *%rbp
lea    0xf10(%rip),%rdi
xor    %eax,%eax
call   *%rbp
lea    0xf17(%rip),%rdi
mov    $0xffffffff8171aab1,%rbp
xor    %eax,%eax
call   *%rbp
mov    %rbx,%rdi
mov    %r14d,%esi
xor    %eax,%eax
call   *%rbp
mov    $0xffffffff811a26e0,%rax
mov    $0x400,%edi
xor    %esi,%esi
call   *%rax
movw   $0x6261,(%rax)
movb   $0x0,0x2(%rax)
mov    %rax,%rdi
xor    %eax,%eax
call   *%rbp
lea    0xec3(%rip),%rdi
xor    %eax,%eax
call   *%rbp
lea    0xf08(%rip),%rax
pop    %rbx
pop    %r14
pop    %rbp
ret

LLVM IR (-O0):
@.str = [67 x i8] c"The attacking code just called printk! : With parameters passing \0A\00"
@.str.1 = [4 x i8] c"%d\0A\00"
@.str.2 = [18 x i8] c"Now test printk:\0A\00"
@.str.3 = [56 x i8] c"Try to call printk without passed as a funtion pointer\0A\00"
@.str.4 = [2 x i8] c"\0A\00"
@.str.5 = [13 x i8] c"Hello World!\00"
define i8* @bar4(i8* %0, i32 %1, i8* %2) {
%4 = alloca i8*
%5 = alloca i32
%6 = alloca i8*
%7 = alloca void (i8*, ...)*
%8 = alloca i8*
%9 = alloca void (i8*, ...)*
%10 = alloca i8* (i32, i32)*
%11 = alloca i8*
store i8* %0, i8** %4
store i32 %1, i32* %5
store i8* %2, i8** %6
%12 = load i8*, i8** %4
%13 = bitcast i8* %12 to void (i8*, ...)*
store void (i8*, ...)* %13, void (i8*, ...)** %7
%14 = load void (i8*, ...)*, void (i8*, ...)** %7
%15 = load void (i8*, ...)*, void (i8*, ...)** %7
%16 = load i8*, i8** %6
%17 = load void (i8*, ...)*, void (i8*, ...)** %7
%18 = load i32, i32* %5
store i8* inttoptr (i64 -2123257167 to i8*), i8** %8
%19 = load i8*, i8** %8
%20 = bitcast i8* %19 to void (i8*, ...)*
store void (i8*, ...)* %20, void (i8*, ...)** %9
%21 = load void (i8*, ...)*, void (i8*, ...)** %7
%22 = load void (i8*, ...)*, void (i8*, ...)** %9
%23 = load void (i8*, ...)*, void (i8*, ...)** %9
%24 = load i32, i32* %5
store i8* (i32, i32)* inttoptr (i64 -2128992544 to i8* (i32, i32)*), i8* (i32, i32)** %10
%25 = load i8* (i32, i32)*, i8* (i32, i32)** %10
%26 = call i8* %25(i32 1024, i32 0)
store i8* %26, i8** %11
%27 = load i8*, i8** %11
%28 = getelementptr inbounds i8, i8* %27, i64 0
store i8 97, i8* %28
%29 = load i8*, i8** %11
%30 = getelementptr inbounds i8, i8* %29, i64 1
store i8 98, i8* %30
%31 = load i8*, i8** %11
%32 = getelementptr inbounds i8, i8* %31, i64 2
store i8 0, i8* %32
%33 = load void (i8*, ...)*, void (i8*, ...)** %9
%34 = load i8*, i8** %11
%35 = load void (i8*, ...)*, void (i8*, ...)** %9
ret i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.5, i64 0, i64 0)
}

LLVM IR (-O2):
@.str = [67 x i8] c"The attacking code just called printk! : With parameters passing \0A\00"
@.str.1 = [4 x i8] c"%d\0A\00"
@.str.2 = [18 x i8] c"Now test printk:\0A\00"
@.str.3 = [56 x i8] c"Try to call printk without passed as a funtion pointer\0A\00"
@.str.4 = [2 x i8] c"\0A\00"
@.str.5 = [13 x i8] c"Hello World!\00"
define i8* @bar4(i8* nocapture %0, i32 %1, i8* %2) {
%4 = bitcast i8* %0 to void (i8*, ...)*
tail call void (i8*, ...) %4(i8* getelementptr inbounds ([67 x i8], [67 x i8]* @.str, i64 0, i64 0))
tail call void (i8*, ...) %4(i8* %2)
tail call void (i8*, ...) %4(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i64 0, i64 0), i32 %1)
tail call void (i8*, ...) %4(i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.2, i64 0, i64 0))
tail call void (i8*, ...) inttoptr (i64 -2123257167 to void (i8*, ...)*)(i8* getelementptr inbounds ([56 x i8], [56 x i8]* @.str.3, i64 0, i64 0))
tail call void (i8*, ...) inttoptr (i64 -2123257167 to void (i8*, ...)*)(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i64 0, i64 0), i32 %1)
%5 = tail call i8* inttoptr (i64 -2128992544 to i8* (i32, i32)*)(i32 1024, i32 0)
store i8 97, i8* %5
%6 = getelementptr inbounds i8, i8* %5, i64 1
store i8 98, i8* %6
%7 = getelementptr inbounds i8, i8* %5, i64 2
store i8 0, i8* %7
tail call void (i8*, ...) inttoptr (i64 -2123257167 to void (i8*, ...)*)(i8* %5)
tail call void (i8*, ...) inttoptr (i64 -2123257167 to void (i8*, ...)*)(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.4, i64 0, i64 0))
ret i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.5, i64 0, i64 0)
}