#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
unsigned int lw_open(char *, int, int /*<<< orphan*/);
long lw_read(unsigned int, char *, int);
unsigned long lw_strlen(char *);
int /*<<< orphan*/ lw_strncpy(void *, char *, unsigned long);
char *lw_strstr(char *, char *);
int find_libc(void *out, unsigned long count) {
  char buf[4096 + 1] = {0};
  char *needle = NULL;
  unsigned int fd;
  unsigned long slen = 0;
  long len = 0;
  if (0 >= (fd = lw_open("/proc/self/maps", 0x0000, 0))) {
    return -1;
  }
  if (0 >= (len = lw_read(fd, buf, 4096))) {
    return -2;
  }
  if (NULL == (needle = lw_strstr(buf, "libc-"))) {
    return -3;
  }
  slen = lw_strlen(buf);
  lw_strncpy(out, (char *)(needle - (70 + 25)), slen);
  return 0;
}


x86 assembly (clang, -O0):
<find_libc>:
push   %rbp
mov    %rsp,%rbp
sub    $0x1040,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
lea    -0x1020(%rbp),%rdi
xor    %esi,%esi
mov    $0x1001,%edx
call   1050 <memset@plt>
movq   $0x0,-0x1028(%rbp)
movq   $0x0,-0x1038(%rbp)
movq   $0x0,-0x1040(%rbp)
lea    0xe52(%rip),%rdi
xor    %edx,%edx
mov    %edx,%esi
call   1030 <lw_open@plt>
mov    %eax,%ecx
mov    %ecx,-0x102c(%rbp)
xor    %eax,%eax
cmp    %ecx,%eax
jb     11d5 <find_libc+0x75>
movl   $0xffffffff,-0x4(%rbp)
jmp    1276 <find_libc+0x116>
mov    -0x102c(%rbp),%edi
lea    -0x1020(%rbp),%rsi
mov    $0x1000,%edx
call   1040 <lw_read@plt>
mov    %rax,%rcx
mov    %rcx,-0x1040(%rbp)
xor    %eax,%eax
cmp    %rcx,%rax
jl     120d <find_libc+0xad>
movl   $0xfffffffe,-0x4(%rbp)
jmp    1276 <find_libc+0x116>
lea    -0x1020(%rbp),%rdi
lea    0xdf5(%rip),%rsi
call   1080 <lw_strstr@plt>
mov    %rax,%rcx
mov    %rcx,-0x1028(%rbp)
xor    %eax,%eax
cmp    %rcx,%rax
jne    1241 <find_libc+0xe1>
movl   $0xfffffffd,-0x4(%rbp)
jmp    1276 <find_libc+0x116>
lea    -0x1020(%rbp),%rdi
call   1060 <lw_strlen@plt>
mov    %rax,-0x1038(%rbp)
mov    -0x10(%rbp),%rdi
mov    -0x1028(%rbp),%rsi
add    $0xffffffffffffffa1,%rsi
mov    -0x1038(%rbp),%rdx
call   1070 <lw_strncpy@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x1040,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<find_libc>:
push   %r14
push   %rbx
sub    $0x1008,%rsp
mov    %rdi,%r14
mov    %rsp,%rdi
mov    $0x1001,%edx
xor    %esi,%esi
call   1050 <memset@plt>
lea    0xe7d(%rip),%rdi
xor    %esi,%esi
xor    %edx,%edx
call   1030 <lw_open@plt>
test   %eax,%eax
je     11d9 <find_libc+0x79>
mov    %rsp,%rsi
mov    %eax,%edi
mov    $0x1000,%edx
call   1040 <lw_read@plt>
test   %rax,%rax
jle    11e0 <find_libc+0x80>
lea    0xe65(%rip),%rsi
mov    %rsp,%rdi
call   1080 <lw_strstr@plt>
test   %rax,%rax
je     11e7 <find_libc+0x87>
mov    %rax,%rbx
mov    %rsp,%rdi
call   1060 <lw_strlen@plt>
add    $0xffffffffffffffa1,%rbx
mov    %r14,%rdi
mov    %rbx,%rsi
mov    %rax,%rdx
call   1070 <lw_strncpy@plt>
xor    %eax,%eax
jmp    11ec <find_libc+0x8c>
mov    $0xffffffff,%eax
jmp    11ec <find_libc+0x8c>
mov    $0xfffffffe,%eax
jmp    11ec <find_libc+0x8c>
mov    $0xfffffffd,%eax
add    $0x1008,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@.str = [16 x i8] c"/proc/self/maps\00"
@.str.1 = [6 x i8] c"libc-\00"
define i32 @find_libc(i8* %0, i64 %1) {
%3 = alloca i32
%4 = alloca i8*
%5 = alloca i64
%6 = alloca [4097 x i8]
%7 = alloca i8*
%8 = alloca i32
%9 = alloca i64
%10 = alloca i64
store i8* %0, i8** %4
store i64 %1, i64* %5
%11 = bitcast [4097 x i8]* %6 to i8*
store i8* null, i8** %7
store i64 0, i64* %9
store i64 0, i64* %10
%12 = call i32 @lw_open(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str, i64 0, i64 0), i32 0, i32 0)
store i32 %12, i32* %8
%13 = icmp uge i32 0, %12
br i1 %13, label %14, label %15
14: ; preds = %2
store i32 -1, i32* %3
br label %34
15: ; preds = %2
%16 = load i32, i32* %8
%17 = getelementptr inbounds [4097 x i8], [4097 x i8]* %6, i64 0, i64 0
%18 = call i64 @lw_read(i32 %16, i8* %17, i32 4096)
store i64 %18, i64* %10
%19 = icmp sge i64 0, %18
br i1 %19, label %20, label %21
20: ; preds = %15
store i32 -2, i32* %3
br label %34
21: ; preds = %15
%22 = getelementptr inbounds [4097 x i8], [4097 x i8]* %6, i64 0, i64 0
%23 = call i8* @lw_strstr(i8* %22, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0))
store i8* %23, i8** %7
%24 = icmp eq i8* null, %23
br i1 %24, label %25, label %26
25: ; preds = %21
store i32 -3, i32* %3
br label %34
26: ; preds = %21
%27 = getelementptr inbounds [4097 x i8], [4097 x i8]* %6, i64 0, i64 0
%28 = call i64 @lw_strlen(i8* %27)
store i64 %28, i64* %9
%29 = load i8*, i8** %4
%30 = load i8*, i8** %7
%31 = getelementptr inbounds i8, i8* %30, i64 -95
%32 = load i64, i64* %9
%33 = call i32 @lw_strncpy(i8* %29, i8* %31, i64 %32)
store i32 0, i32* %3
br label %34
34: ; preds = %26, %25, %20, %14
%35 = load i32, i32* %3
ret i32 %35
}

LLVM IR (-O2):
@.str = [16 x i8] c"/proc/self/maps\00"
@.str.1 = [6 x i8] c"libc-\00"
define i32 @find_libc(i8* %0, i64 %1) {
%3 = alloca [4097 x i8]
%4 = getelementptr inbounds [4097 x i8], [4097 x i8]* %3, i64 0, i64 0
%5 = tail call i32 @lw_open(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str, i64 0, i64 0), i32 0, i32 0)
%6 = icmp eq i32 %5, 0
br i1 %6, label %17, label %7
7: ; preds = %2
%8 = call i64 @lw_read(i32 %5, i8* %4, i32 4096)
%9 = icmp slt i64 %8, 1
br i1 %9, label %17, label %10
10: ; preds = %7
%11 = call i8* @lw_strstr(i8* %4, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0))
%12 = icmp eq i8* %11, null
br i1 %12, label %17, label %13
13: ; preds = %10
%14 = call i64 @lw_strlen(i8* %4)
%15 = getelementptr inbounds i8, i8* %11, i64 -95
%16 = call i32 @lw_strncpy(i8* %0, i8* %15, i64 %14)
br label %17
17: ; preds = %10, %7, %2, %13
%18 = phi i32 [ 0, %13 ], [ -1, %2 ], [ -2, %7 ], [ -3, %10 ]
ret i32 %18
}