#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int pid_t;
typedef int /*<<< orphan*/ mapbuf;
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ errno;
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
scalar_t__ fgets(char *, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char *, char *);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, char *, char *);
int /*<<< orphan*/ sprintf(char *, char *, int);
int /*<<< orphan*/ sscanf(char *, char *, unsigned long *, unsigned long *,
                          char *, unsigned long *, unsigned long *,
                          unsigned long *, unsigned long *, char *);
int /*<<< orphan*/ stderr;
char *strerror(int /*<<< orphan*/);
int /*<<< orphan*/ strncmp(char *, char *, int);
char *strrchr(char *, char);
scalar_t__ strstr(char *, char *);
unsigned long find_lib_base(pid_t pid, char *so_hint) {
  FILE *fp;
  char maps[4096], mapbuf[4096], perms[32], libpath[4096];
  char *libname;
  unsigned long start, end, file_offset, inode, dev_major, dev_minor;
  sprintf(maps, "/proc/%d/maps", pid);
  fp = fopen(maps, "rb");
  if (!fp) {
    fprintf(stderr, "Failed to open %s: %s\n", maps, strerror(errno));
    return 0;
  }
  while (fgets(mapbuf, sizeof(mapbuf), fp)) {
    sscanf(mapbuf, "%lx-%lx %s %lx %lx:%lx %lu %s", &start, &end, perms,
           &file_offset, &dev_major, &dev_minor, &inode, libpath);
    libname = strrchr(libpath, '/');
    if (libname)
      libname++;
    else
      continue;
    if (!strncmp(perms, "r-xp", 4) && strstr(libname, so_hint)) {
      fclose(fp);
      return start;
    }
  }
  fclose(fp);
  return 0;
}


x86 assembly (clang, -O0):
<find_lib_base>:
push   %rbp
mov    %rsp,%rbp
push   %rbx
sub    $0x30b8,%rsp
mov    %edi,-0x14(%rbp)
mov    %rsi,-0x20(%rbp)
lea    -0x1030(%rbp),%rdi
mov    -0x14(%rbp),%edx
lea    0xe3c(%rip),%rsi
call   10a0 <sprintf@plt>
lea    -0x1030(%rbp),%rdi
lea    0xe37(%rip),%rsi
call   1090 <fopen@plt>
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x28(%rbp)
jne    123f <find_lib_base+0x9f>
mov    0x2dee(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x3094(%rbp)
lea    -0x1030(%rbp),%rax
mov    %rax,-0x3090(%rbp)
mov    0x2dc9(%rip),%rax
mov    (%rax),%edi
call   10b0 <strerror@plt>
mov    -0x3094(%rbp),%edi
mov    -0x3090(%rbp),%rdx
mov    %rax,%rcx
lea    0xde4(%rip),%rsi
call   1070 <fprintf@plt>
movq   $0x0,-0x10(%rbp)
jmp    136d <find_lib_base+0x1cd>
jmp    1244 <find_lib_base+0xa4>
lea    -0x2030(%rbp),%rdi
mov    -0x28(%rbp),%rdx
mov    $0x1000,%esi
call   1060 <fgets@plt>
cmp    $0x0,%rax
je     135c <find_lib_base+0x1bc>
lea    -0x2030(%rbp),%rdi
lea    -0x2050(%rbp),%r8
lea    -0x3050(%rbp),%rax
lea    0xda9(%rip),%rsi
lea    -0x3060(%rbp),%rdx
lea    -0x3068(%rbp),%rcx
lea    -0x3070(%rbp),%r9
lea    -0x3080(%rbp),%rbx
lea    -0x3088(%rbp),%r11
lea    -0x3078(%rbp),%r10
mov    %rbx,(%rsp)
mov    %r11,0x8(%rsp)
mov    %r10,0x10(%rsp)
mov    %rax,0x18(%rsp)
call   1080 <sscanf@plt>
lea    -0x3050(%rbp),%rdi
mov    $0x2f,%esi
call   1050 <strrchr@plt>
mov    %rax,-0x3058(%rbp)
cmpq   $0x0,-0x3058(%rbp)
je     12fe <find_lib_base+0x15e>
mov    -0x3058(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x3058(%rbp)
jmp    1303 <find_lib_base+0x163>
jmp    1244 <find_lib_base+0xa4>
lea    -0x2050(%rbp),%rdi
lea    0xd35(%rip),%rsi
mov    $0x4,%edx
call   1030 <strncmp@plt>
cmp    $0x0,%eax
jne    1357 <find_lib_base+0x1b7>
mov    -0x3058(%rbp),%rdi
mov    -0x20(%rbp),%rsi
call   10c0 <strstr@plt>
cmp    $0x0,%rax
je     1357 <find_lib_base+0x1b7>
mov    -0x28(%rbp),%rdi
call   1040 <fclose@plt>
mov    -0x3060(%rbp),%rax
mov    %rax,-0x10(%rbp)
jmp    136d <find_lib_base+0x1cd>
jmp    1244 <find_lib_base+0xa4>
mov    -0x28(%rbp),%rdi
call   1040 <fclose@plt>
movq   $0x0,-0x10(%rbp)
mov    -0x10(%rbp),%rax
add    $0x30b8,%rsp
pop    %rbx
pop    %rbp
ret

x86 assembly (clang, -O2):
<find_lib_base>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x3068,%rsp
mov    %rsi,0x8(%rsp)
mov    %edi,%edx
lea    0xe41(%rip),%rsi
lea    0x1060(%rsp),%rbx
mov    %rbx,%rdi
call   10a0 <sprintf@plt>
lea    0xe38(%rip),%rsi
mov    %rbx,%rdi
call   1090 <fopen@plt>
test   %rax,%rax
je     12d0 <find_lib_base+0x130>
mov    %rax,%rbx
lea    0x60(%rsp),%rdi
mov    $0x1000,%esi
mov    %rax,%rdx
call   1060 <fgets@plt>
test   %rax,%rax
je     12c6 <find_lib_base+0x126>
lea    0x2060(%rsp),%r15
lea    0x60(%rsp),%r13
lea    0x40(%rsp),%r12
lea    0x30(%rsp),%rbp
jmp    1239 <find_lib_base+0x99>
xchg   %ax,%ax
mov    %r13,%rdi
mov    $0x1000,%esi
mov    %rbx,%rdx
call   1060 <fgets@plt>
test   %rax,%rax
je     12c6 <find_lib_base+0x126>
mov    %r13,%rdi
lea    0xde5(%rip),%rsi
lea    0x10(%rsp),%rdx
lea    0x38(%rsp),%rcx
mov    %r12,%r8
mov    %rbp,%r9
push   %r15
lea    0x30(%rsp),%rax
push   %rax
lea    0x28(%rsp),%rax
push   %rax
lea    0x38(%rsp),%rax
push   %rax
call   1080 <sscanf@plt>
add    $0x20,%rsp
mov    %r15,%rdi
mov    $0x2f,%esi
call   1050 <strrchr@plt>
test   %rax,%rax
je     1220 <find_lib_base+0x80>
mov    %rax,%r14
mov    %r12,%rdi
lea    0xdb7(%rip),%rsi
mov    $0x4,%edx
call   1030 <strncmp@plt>
test   %eax,%eax
jne    1220 <find_lib_base+0x80>
add    $0x1,%r14
mov    %r14,%rdi
mov    0x8(%rsp),%rsi
call   10c0 <strstr@plt>
test   %rax,%rax
je     1220 <find_lib_base+0x80>
mov    %rbx,%rdi
call   1040 <fclose@plt>
mov    0x10(%rsp),%rax
jmp    1302 <find_lib_base+0x162>
mov    %rbx,%rdi
call   1040 <fclose@plt>
jmp    1300 <find_lib_base+0x160>
mov    0x2d09(%rip),%rax
mov    (%rax),%ebx
mov    0x2cf8(%rip),%rax
mov    (%rax),%edi
call   10b0 <strerror@plt>
lea    0xd23(%rip),%rsi
lea    0x1060(%rsp),%rdx
mov    %ebx,%edi
mov    %rax,%rcx
call   1070 <fprintf@plt>
xor    %eax,%eax
add    $0x3068,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [14 x i8] c"/proc/%d/maps\00"
@.str.1 = [3 x i8] c"rb\00"
@stderr = global i32 0
@.str.2 = [23 x i8] c"Failed to open %s: %s\0A\00"
@errno = global i32 0
@.str.3 = [30 x i8] c"%lx-%lx %s %lx %lx:%lx %lu %s\00"
@.str.4 = [5 x i8] c"r-xp\00"
define i64 @find_lib_base(i32 %0, i8* %1) {
%3 = alloca i64
%4 = alloca i32
%5 = alloca i8*
%6 = alloca i32*
%7 = alloca [4096 x i8]
%8 = alloca [4096 x i8]
%9 = alloca [32 x i8]
%10 = alloca [4096 x i8]
%11 = alloca i8*
%12 = alloca i64
%13 = alloca i64
%14 = alloca i64
%15 = alloca i64
%16 = alloca i64
%17 = alloca i64
store i32 %0, i32* %4
store i8* %1, i8** %5
%18 = getelementptr inbounds [4096 x i8], [4096 x i8]* %7, i64 0, i64 0
%19 = load i32, i32* %4
%20 = call i32 @sprintf(i8* %18, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i64 0, i64 0), i32 %19)
%21 = getelementptr inbounds [4096 x i8], [4096 x i8]* %7, i64 0, i64 0
%22 = call i32* @fopen(i8* %21, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
store i32* %22, i32** %6
%23 = load i32*, i32** %6
%24 = icmp ne i32* %23, null
br i1 %24, label %31, label %25
25: ; preds = %2
%26 = load i32, i32* @stderr
%27 = getelementptr inbounds [4096 x i8], [4096 x i8]* %7, i64 0, i64 0
%28 = load i32, i32* @errno
%29 = call i8* @strerror(i32 %28)
%30 = call i32 @fprintf(i32 %26, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.2, i64 0, i64 0), i8* %27, i8* %29)
store i64 0, i64* %3
br label %67
31: ; preds = %2
br label %32
32: ; preds = %63, %49, %31
%33 = getelementptr inbounds [4096 x i8], [4096 x i8]* %8, i64 0, i64 0
%34 = load i32*, i32** %6
%35 = call i64 @fgets(i8* %33, i32 4096, i32* %34)
%36 = icmp ne i64 %35, 0
br i1 %36, label %37, label %64
37: ; preds = %32
%38 = getelementptr inbounds [4096 x i8], [4096 x i8]* %8, i64 0, i64 0
%39 = getelementptr inbounds [32 x i8], [32 x i8]* %9, i64 0, i64 0
%40 = getelementptr inbounds [4096 x i8], [4096 x i8]* %10, i64 0, i64 0
%41 = call i32 @sscanf(i8* %38, i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.3, i64 0, i64 0), i64* %12, i64* %13, i8* %39, i64* %14, i64* %16, i64* %17, i64* %15, i8* %40)
%42 = getelementptr inbounds [4096 x i8], [4096 x i8]* %10, i64 0, i64 0
%43 = call i8* @strrchr(i8* %42, i8 signext 47)
store i8* %43, i8** %11
%44 = load i8*, i8** %11
%45 = icmp ne i8* %44, null
br i1 %45, label %46, label %49
46: ; preds = %37
%47 = load i8*, i8** %11
%48 = getelementptr inbounds i8, i8* %47, i32 1
store i8* %48, i8** %11
br label %50
49: ; preds = %37
br label %32
50: ; preds = %46
%51 = getelementptr inbounds [32 x i8], [32 x i8]* %9, i64 0, i64 0
%52 = call i32 @strncmp(i8* %51, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.4, i64 0, i64 0), i32 4)
%53 = icmp ne i32 %52, 0
br i1 %53, label %63, label %54
54: ; preds = %50
%55 = load i8*, i8** %11
%56 = load i8*, i8** %5
%57 = call i64 @strstr(i8* %55, i8* %56)
%58 = icmp ne i64 %57, 0
br i1 %58, label %59, label %63
59: ; preds = %54
%60 = load i32*, i32** %6
%61 = call i32 @fclose(i32* %60)
%62 = load i64, i64* %12
store i64 %62, i64* %3
br label %67
63: ; preds = %54, %50
br label %32
64: ; preds = %32
%65 = load i32*, i32** %6
%66 = call i32 @fclose(i32* %65)
store i64 0, i64* %3
br label %67
67: ; preds = %64, %59, %25
%68 = load i64, i64* %3
ret i64 %68
}

LLVM IR (-O2):
@.str = [14 x i8] c"/proc/%d/maps\00"
@.str.1 = [3 x i8] c"rb\00"
@stderr = global i32 0
@.str.2 = [23 x i8] c"Failed to open %s: %s\0A\00"
@errno = global i32 0
@.str.3 = [30 x i8] c"%lx-%lx %s %lx %lx:%lx %lu %s\00"
@.str.4 = [5 x i8] c"r-xp\00"
define i64 @find_lib_base(i32 %0, i8* %1) {
%3 = alloca [4096 x i8]
%4 = alloca [4096 x i8]
%5 = alloca [32 x i8]
%6 = alloca [4096 x i8]
%7 = alloca i64
%8 = alloca i64
%9 = alloca i64
%10 = alloca i64
%11 = alloca i64
%12 = alloca i64
%13 = getelementptr inbounds [4096 x i8], [4096 x i8]* %3, i64 0, i64 0
%14 = getelementptr inbounds [4096 x i8], [4096 x i8]* %4, i64 0, i64 0
%15 = getelementptr inbounds [32 x i8], [32 x i8]* %5, i64 0, i64 0
%16 = getelementptr inbounds [4096 x i8], [4096 x i8]* %6, i64 0, i64 0
%17 = bitcast i64* %7 to i8*
%18 = bitcast i64* %8 to i8*
%19 = bitcast i64* %9 to i8*
%20 = bitcast i64* %10 to i8*
%21 = bitcast i64* %11 to i8*
%22 = bitcast i64* %12 to i8*
%23 = call i32 @sprintf(i8* %13, i8* dereferenceable(1) getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i64 0, i64 0), i32 %0)
%24 = call i32* @fopen(i8* %13, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
%25 = icmp eq i32* %24, null
br i1 %25, label %29, label %26
26: ; preds = %2
%27 = call i64 @fgets(i8* %14, i32 4096, i32* %24)
%28 = icmp eq i64 %27, 0
br i1 %28, label %51, label %34
29: ; preds = %2
%30 = load i32, i32* @stderr
%31 = load i32, i32* @errno
%32 = tail call i8* @strerror(i32 %31)
%33 = call i32 @fprintf(i32 %30, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.2, i64 0, i64 0), i8* %13, i8* %32)
br label %53
34: ; preds = %26, %48
%35 = call i32 @sscanf(i8* %14, i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.3, i64 0, i64 0), i64* %7, i64* %8, i8* %15, i64* %9, i64* %11, i64* %12, i64* %10, i8* %16)
%36 = call i8* @strrchr(i8* %16, i8 signext 47)
%37 = icmp eq i8* %36, null
br i1 %37, label %48, label %38
38: ; preds = %34
%39 = call i32 @strncmp(i8* %15, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.4, i64 0, i64 0), i32 4)
%40 = icmp eq i32 %39, 0
br i1 %40, label %41, label %48
41: ; preds = %38
%42 = getelementptr inbounds i8, i8* %36, i64 1
%43 = call i64 @strstr(i8* %42, i8* %1)
%44 = icmp eq i64 %43, 0
br i1 %44, label %48, label %45
45: ; preds = %41
%46 = call i32 @fclose(i32* %24)
%47 = load i64, i64* %7
br label %53
48: ; preds = %38, %41, %34
%49 = call i64 @fgets(i8* %14, i32 4096, i32* %24)
%50 = icmp eq i64 %49, 0
br i1 %50, label %51, label %34
51: ; preds = %48, %26
%52 = call i32 @fclose(i32* %24)
br label %53
53: ; preds = %51, %45, %29
%54 = phi i64 [ %47, %45 ], [ 0, %51 ], [ 0, %29 ]
ret i64 %54
}