#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ SSL;

/* Variables and functions */
int guess_last_byte(int /*<<< orphan*/ *, unsigned char *);
int /*<<< orphan*/ memcpy(unsigned char *, unsigned char *, unsigned int);
int /*<<< orphan*/ memset(unsigned char *, int /*<<< orphan*/, unsigned int);
int /*<<< orphan*/ oracle_free(int /*<<< orphan*/ *);
int /*<<< orphan*/ *oracle_query(char *, unsigned int, unsigned char *, int,
                                 unsigned char *, unsigned int);
int run_oracle_guess(char *hostport, unsigned int keysize,
                     unsigned char *encrypted_key,
                     unsigned int encrypted_key_length, unsigned char *result) {
  int res;
  unsigned char guess_array[keysize * 2];
  memset(guess_array, 0, keysize * 2);
  unsigned char *master_key_guess = guess_array;
  for (int clear_len = keysize - 1; clear_len >= 0; clear_len--) {
    SSL *ssl = oracle_query(hostport, keysize, ++master_key_guess, clear_len,
                            encrypted_key, encrypted_key_length);
    res = guess_last_byte(ssl, &master_key_guess[keysize - 1]);
    oracle_free(ssl);
    if (!res) {
      return 0;
    }
  }
  memcpy(result, master_key_guess, keysize);
  return 1;
}


x86 assembly (clang, -O0):
<run_oracle_guess>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
mov    %rdi,-0x10(%rbp)
mov    %esi,-0x14(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %ecx,-0x24(%rbp)
mov    %r8,-0x30(%rbp)
mov    -0x14(%rbp),%eax
add    %eax,%eax
mov    %rsp,%rcx
mov    %rcx,-0x40(%rbp)
mov    %rax,%rcx
add    $0xf,%rcx
and    $0xfffffffffffffff0,%rcx
mov    %rsp,%rdi
sub    %rcx,%rdi
mov    %rdi,-0x70(%rbp)
mov    %rdi,%rsp
mov    %rax,-0x48(%rbp)
mov    -0x14(%rbp),%edx
shl    $0x1,%edx
xor    %esi,%esi
call   1040 <memset@plt>
mov    -0x70(%rbp),%rax
mov    %rax,-0x50(%rbp)
mov    -0x14(%rbp),%eax
sub    $0x1,%eax
mov    %eax,-0x54(%rbp)
cmpl   $0x0,-0x54(%rbp)
jl     1235 <run_oracle_guess+0xe5>
mov    -0x10(%rbp),%rdi
mov    -0x14(%rbp),%esi
mov    -0x50(%rbp),%rdx
add    $0x1,%rdx
mov    %rdx,-0x50(%rbp)
mov    -0x54(%rbp),%ecx
mov    -0x20(%rbp),%r8
mov    -0x24(%rbp),%r9d
call   1060 <oracle_query@plt>
mov    %rax,-0x60(%rbp)
mov    -0x60(%rbp),%rdi
mov    -0x50(%rbp),%rsi
mov    -0x14(%rbp),%eax
sub    $0x1,%eax
mov    %eax,%eax
add    %rax,%rsi
call   1030 <guess_last_byte@plt>
mov    %eax,-0x34(%rbp)
mov    -0x60(%rbp),%rdi
call   1070 <oracle_free@plt>
cmpl   $0x0,-0x34(%rbp)
jne    1222 <run_oracle_guess+0xd2>
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x64(%rbp)
jmp    1253 <run_oracle_guess+0x103>
jmp    1227 <run_oracle_guess+0xd7>
mov    -0x54(%rbp),%eax
add    $0xffffffff,%eax
mov    %eax,-0x54(%rbp)
jmp    11b0 <run_oracle_guess+0x60>
mov    -0x30(%rbp),%rdi
mov    -0x50(%rbp),%rsi
mov    -0x14(%rbp),%edx
call   1050 <memcpy@plt>
movl   $0x1,-0x4(%rbp)
movl   $0x1,-0x64(%rbp)
mov    -0x40(%rbp),%rax
mov    %rax,%rsp
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<run_oracle_guess>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x28,%rsp
mov    %r8,%r14
mov    %ecx,-0x2c(%rbp)
mov    %rdx,-0x50(%rbp)
mov    %esi,%r13d
mov    %rdi,-0x48(%rbp)
lea    0x0(%r13,%r13,1),%edx
mov    %rsp,%r12
lea    0xf(%rdx),%rax
and    $0xfffffffffffffff0,%rax
sub    %rax,%r12
mov    %r12,%rsp
mov    %r12,%rdi
xor    %esi,%esi
call   1040 <memset@plt>
mov    %r13d,%eax
add    $0xffffffff,%eax
mov    %r14,-0x38(%rbp)
js     1202 <run_oracle_guess+0xb2>
mov    %eax,%eax
add    $0x1,%rax
mov    %rax,-0x40(%rbp)
mov    %r13d,%r15d
nopl   0x0(%rax,%rax,1)
mov    %r12,%r14
add    $0xffffffff,%r15d
add    $0x1,%r12
mov    -0x48(%rbp),%rdi
mov    %r13,%rbx
mov    %r13d,%esi
mov    %r12,%rdx
mov    %r15d,%ecx
mov    -0x50(%rbp),%r8
mov    -0x2c(%rbp),%r9d
call   1060 <oracle_query@plt>
mov    %rax,%r13
add    -0x40(%rbp),%r14
mov    %rax,%rdi
mov    %r14,%rsi
call   1030 <guess_last_byte@plt>
mov    %eax,%r14d
mov    %r13,%rdi
call   1070 <oracle_free@plt>
test   %r14d,%r14d
je     1218 <run_oracle_guess+0xc8>
test   %r15d,%r15d
mov    %rbx,%r13
jg     11b0 <run_oracle_guess+0x60>
mov    -0x38(%rbp),%rdi
mov    %r12,%rsi
mov    %r13d,%edx
call   1050 <memcpy@plt>
mov    $0x1,%eax
jmp    121a <run_oracle_guess+0xca>
xor    %eax,%eax
lea    -0x28(%rbp),%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @run_oracle_guess(i8* %0, i32 %1, i8* %2, i32 %3, i8* %4) {
%6 = alloca i32
%7 = alloca i8*
%8 = alloca i32
%9 = alloca i8*
%10 = alloca i32
%11 = alloca i8*
%12 = alloca i32
%13 = alloca i8*
%14 = alloca i64
%15 = alloca i8*
%16 = alloca i32
%17 = alloca i32*
%18 = alloca i32
store i8* %0, i8** %7
store i32 %1, i32* %8
store i8* %2, i8** %9
store i32 %3, i32* %10
store i8* %4, i8** %11
%19 = load i32, i32* %8
%20 = mul i32 %19, 2
%21 = zext i32 %20 to i64
%22 = call i8* @llvm.stacksave()
store i8* %22, i8** %13
%23 = alloca i8, i64 %21
store i64 %21, i64* %14
%24 = load i32, i32* %8
%25 = mul i32 %24, 2
%26 = call i32 @memset(i8* %23, i32 0, i32 %25)
store i8* %23, i8** %15
%27 = load i32, i32* %8
%28 = sub i32 %27, 1
store i32 %28, i32* %16
br label %29
29: ; preds = %54, %5
%30 = load i32, i32* %16
%31 = icmp sge i32 %30, 0
br i1 %31, label %32, label %57
32: ; preds = %29
%33 = load i8*, i8** %7
%34 = load i32, i32* %8
%35 = load i8*, i8** %15
%36 = getelementptr inbounds i8, i8* %35, i32 1
store i8* %36, i8** %15
%37 = load i32, i32* %16
%38 = load i8*, i8** %9
%39 = load i32, i32* %10
%40 = call i32* @oracle_query(i8* %33, i32 %34, i8* %36, i32 %37, i8* %38, i32 %39)
store i32* %40, i32** %17
%41 = load i32*, i32** %17
%42 = load i8*, i8** %15
%43 = load i32, i32* %8
%44 = sub i32 %43, 1
%45 = zext i32 %44 to i64
%46 = getelementptr inbounds i8, i8* %42, i64 %45
%47 = call i32 @guess_last_byte(i32* %41, i8* %46)
store i32 %47, i32* %12
%48 = load i32*, i32** %17
%49 = call i32 @oracle_free(i32* %48)
%50 = load i32, i32* %12
%51 = icmp ne i32 %50, 0
br i1 %51, label %53, label %52
52: ; preds = %32
store i32 0, i32* %6
store i32 1, i32* %18
br label %62
53: ; preds = %32
br label %54
54: ; preds = %53
%55 = load i32, i32* %16
%56 = add nsw i32 %55, -1
store i32 %56, i32* %16
br label %29
57: ; preds = %29
%58 = load i8*, i8** %11
%59 = load i8*, i8** %15
%60 = load i32, i32* %8
%61 = call i32 @memcpy(i8* %58, i8* %59, i32 %60)
store i32 1, i32* %6
store i32 1, i32* %18
br label %62
62: ; preds = %57, %52
%63 = load i8*, i8** %13
%64 = load i32, i32* %6
ret i32 %64
}

LLVM IR (-O2):
define i32 @run_oracle_guess(i8* %0, i32 %1, i8* %2, i32 %3, i8* %4) {
%6 = shl i32 %1, 1
%7 = zext i32 %6 to i64
%8 = alloca i8, i64 %7
%9 = call i32 @memset(i8* %8, i32 0, i32 %6)
%10 = add i32 %1, -1
%11 = icmp sgt i32 %10, -1
br i1 %11, label %12, label %26
12: ; preds = %5
%13 = zext i32 %10 to i64
br label %17
14: ; preds = %17
%15 = add nsw i32 %18, -1
%16 = icmp sgt i32 %18, 0
br i1 %16, label %17, label %26
17: ; preds = %12, %14
%18 = phi i32 [ %10, %12 ], [ %15, %14 ]
%19 = phi i8* [ %8, %12 ], [ %20, %14 ]
%20 = getelementptr inbounds i8, i8* %19, i64 1
%21 = call i32* @oracle_query(i8* %0, i32 %1, i8* %20, i32 %18, i8* %2, i32 %3)
%22 = getelementptr inbounds i8, i8* %20, i64 %13
%23 = call i32 @guess_last_byte(i32* %21, i8* %22)
%24 = call i32 @oracle_free(i32* %21)
%25 = icmp eq i32 %23, 0
br i1 %25, label %29, label %14
26: ; preds = %14, %5
%27 = phi i8* [ %8, %5 ], [ %20, %14 ]
%28 = call i32 @memcpy(i8* %4, i8* %27, i32 %1)
br label %29
29: ; preds = %17, %26
%30 = phi i32 [ 1, %26 ], [ 0, %17 ]
ret i32 %30
}