#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_10__ TYPE_3__;
typedef struct TYPE_9__ TYPE_1__;

/* Type definitions */
struct TYPE_10__ {
  scalar_t__ r_offset;
  int /*<<< orphan*/ r_info;
};
struct TYPE_9__ {
  int sh_size;
  scalar_t__ sh_addr;
};
typedef TYPE_1__ Elf64_Sym;
typedef TYPE_1__ Elf64_Shdr;
typedef TYPE_3__ Elf64_Rela;

/* Variables and functions */
size_t ELF64_R_SYM(int /*<<< orphan*/);
int /*<<< orphan*/ O_RDONLY;
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ SHT_DYNSYM;
int /*<<< orphan*/ _SC_PAGESIZE;
int /*<<< orphan*/ close(int);
scalar_t__ errno;
int /*<<< orphan*/ free(TYPE_1__ *);
int /*<<< orphan*/ mprotect(void *, size_t, int);
int open(char const *, int /*<<< orphan*/);
scalar_t__ section_by_name(int, char *, TYPE_1__ **);
scalar_t__ section_by_type(int, int /*<<< orphan*/, TYPE_1__ **);
scalar_t__ symbol_by_name(int, TYPE_1__ *, char const *, TYPE_1__ **, size_t *);
size_t sysconf(int /*<<< orphan*/);
void *elf_hook(char const *module_filename, void const *module_address,
               char const *name, void const *substitution) {
  static size_t pagesize;
  int descriptor;
  Elf64_Shdr *dynsym = NULL, *rel_plt = NULL, *rel_dyn = NULL;
  Elf64_Sym *symbol = NULL;
  Elf64_Rela *rel_plt_table = NULL, *rel_dyn_table = NULL;
  size_t i, name_index, rel_plt_amount, rel_dyn_amount, *name_address = NULL;
  void *original = NULL;
  if (NULL == module_address || NULL == name || NULL == substitution)
    return original;
  if (!pagesize)
    pagesize = sysconf(_SC_PAGESIZE);
  descriptor = open(module_filename, O_RDONLY);
  if (descriptor < 0)
    return original;
  if (section_by_type(descriptor, SHT_DYNSYM, &dynsym) ||
      symbol_by_name(descriptor, dynsym, name, &symbol, &name_index) ||
      section_by_name(descriptor, ".rela.plt", &rel_plt) ||
      section_by_name(descriptor, ".rela.dyn", &rel_dyn)) {
    free(dynsym);
    free(rel_plt);
    free(rel_dyn);
    free(symbol);
    close(descriptor);
    return original;
  }
  free(dynsym);
  free(symbol);
  rel_plt_table = (Elf64_Rela *)(((size_t)module_address) + rel_plt->sh_addr);
  rel_plt_amount = rel_plt->sh_size / sizeof(Elf64_Rela);
  rel_dyn_table = (Elf64_Rela *)(((size_t)module_address) + rel_dyn->sh_addr);
  rel_dyn_amount = rel_dyn->sh_size / sizeof(Elf64_Rela);
  free(rel_plt);
  free(rel_dyn);
  close(descriptor);
  for (i = 0; i < rel_plt_amount; ++i)
    if (ELF64_R_SYM(rel_plt_table[i].r_info) == name_index) {
      name_address =
          (size_t *)(((size_t)module_address) + rel_plt_table[i].r_offset);
      original = (void *)*name_address;
      mprotect(
          (void *)(((size_t)name_address) & (((size_t)-1) ^ (pagesize - 1))),
          pagesize, PROT_READ | PROT_WRITE | PROT_EXEC);
      *name_address = (size_t)substitution;
      break;
    }
  if (original)
    return original;
  for (i = 0; i < rel_dyn_amount; ++i)
    if (ELF64_R_SYM(rel_dyn_table[i].r_info) == name_index) {
      name_address =
          (size_t *)(((size_t)module_address) + rel_dyn_table[i].r_offset);
      if (!original)
        original =
            (void *)(*name_address + (size_t)name_address + sizeof(size_t));
      mprotect(
          (void *)(((size_t)name_address) & (((size_t)-1) ^ (pagesize - 1))),
          pagesize, PROT_READ | PROT_WRITE);
      if (errno)
        return NULL;
      *name_address =
          (size_t)substitution - (size_t)name_address - sizeof(size_t);
      mprotect(
          (void *)(((size_t)name_address) & (((size_t)-1) ^ (pagesize - 1))),
          pagesize, PROT_READ | PROT_EXEC);
      if (errno) {
        *name_address =
            (size_t)original - (size_t)name_address - sizeof(size_t);
        return NULL;
      }
    }
  return original;
}


x86 assembly (clang, -O0):
<elf_hook>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
movq   $0x0,-0x38(%rbp)
movq   $0x0,-0x40(%rbp)
movq   $0x0,-0x48(%rbp)
movq   $0x0,-0x50(%rbp)
movq   $0x0,-0x58(%rbp)
movq   $0x0,-0x60(%rbp)
movq   $0x0,-0x88(%rbp)
movq   $0x0,-0x90(%rbp)
xor    %eax,%eax
cmp    -0x18(%rbp),%rax
je     1215 <elf_hook+0x85>
xor    %eax,%eax
cmp    -0x20(%rbp),%rax
je     1215 <elf_hook+0x85>
xor    %eax,%eax
cmp    -0x28(%rbp),%rax
jne    1225 <elf_hook+0x95>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    1610 <elf_hook+0x480>
cmpq   $0x0,0x2e43(%rip)
jne    1248 <elf_hook+0xb8>
mov    0x2d96(%rip),%rax
mov    (%rax),%edi
call   10a0 <sysconf@plt>
mov    %rax,0x2e28(%rip)
mov    -0x10(%rbp),%rdi
mov    0x2d8d(%rip),%rax
mov    (%rax),%esi
call   1090 <open@plt>
mov    %eax,-0x2c(%rbp)
cmpl   $0x0,-0x2c(%rbp)
jge    1277 <elf_hook+0xe7>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    1610 <elf_hook+0x480>
mov    -0x2c(%rbp),%edi
mov    0x2d57(%rip),%rax
mov    (%rax),%esi
lea    -0x38(%rbp),%rdx
call   10b0 <section_by_type@plt>
cmp    $0x0,%rax
jne    12f2 <elf_hook+0x162>
mov    -0x2c(%rbp),%edi
mov    -0x38(%rbp),%rsi
mov    -0x20(%rbp),%rdx
lea    -0x50(%rbp),%rcx
lea    -0x70(%rbp),%r8
call   1060 <symbol_by_name@plt>
cmp    $0x0,%rax
jne    12f2 <elf_hook+0x162>
mov    -0x2c(%rbp),%edi
lea    0xd3e(%rip),%rsi
lea    -0x40(%rbp),%rdx
call   1070 <section_by_name@plt>
cmp    $0x0,%rax
jne    12f2 <elf_hook+0x162>
mov    -0x2c(%rbp),%edi
lea    0xd2b(%rip),%rsi
lea    -0x48(%rbp),%rdx
call   1070 <section_by_name@plt>
cmp    $0x0,%rax
je     132e <elf_hook+0x19e>
mov    -0x38(%rbp),%rdi
call   1030 <free@plt>
mov    -0x40(%rbp),%rdi
call   1030 <free@plt>
mov    -0x48(%rbp),%rdi
call   1030 <free@plt>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
mov    -0x2c(%rbp),%edi
call   1040 <close@plt>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    1610 <elf_hook+0x480>
mov    -0x38(%rbp),%rdi
call   1030 <free@plt>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
mov    -0x18(%rbp),%rax
mov    -0x40(%rbp),%rcx
add    0x8(%rcx),%rax
mov    %rax,-0x58(%rbp)
mov    -0x40(%rbp),%rax
movslq (%rax),%rax
shr    $0x4,%rax
mov    %rax,-0x78(%rbp)
mov    -0x18(%rbp),%rax
mov    -0x48(%rbp),%rcx
add    0x8(%rcx),%rax
mov    %rax,-0x60(%rbp)
mov    -0x48(%rbp),%rax
movslq (%rax),%rax
shr    $0x4,%rax
mov    %rax,-0x80(%rbp)
mov    -0x40(%rbp),%rdi
call   1030 <free@plt>
mov    -0x48(%rbp),%rdi
call   1030 <free@plt>
mov    -0x2c(%rbp),%edi
call   1040 <close@plt>
movq   $0x0,-0x68(%rbp)
mov    -0x68(%rbp),%rax
cmp    -0x78(%rbp),%rax
jae    1466 <elf_hook+0x2d6>
mov    -0x58(%rbp),%rax
mov    -0x68(%rbp),%rcx
shl    $0x4,%rcx
add    %rcx,%rax
mov    0x8(%rax),%edi
call   1050 <ELF64_R_SYM@plt>
cmp    -0x70(%rbp),%rax
jne    1450 <elf_hook+0x2c0>
mov    -0x18(%rbp),%rax
mov    -0x58(%rbp),%rcx
mov    -0x68(%rbp),%rdx
shl    $0x4,%rdx
add    %rdx,%rcx
add    (%rcx),%rax
mov    %rax,-0x88(%rbp)
mov    -0x88(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x90(%rbp)
mov    -0x88(%rbp),%rdi
mov    0x2c65(%rip),%rax
sub    $0x1,%rax
xor    $0xffffffffffffffff,%rax
and    %rax,%rdi
mov    0x2c53(%rip),%rsi
mov    0x2bd4(%rip),%rax
mov    (%rax),%edx
mov    0x2b83(%rip),%rax
or     (%rax),%edx
mov    0x2b92(%rip),%rax
or     (%rax),%edx
call   1080 <mprotect@plt>
mov    -0x28(%rbp),%rcx
mov    -0x88(%rbp),%rax
mov    %rcx,(%rax)
jmp    1466 <elf_hook+0x2d6>
jmp    1455 <elf_hook+0x2c5>
mov    -0x68(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x68(%rbp)
jmp    13a0 <elf_hook+0x210>
cmpq   $0x0,-0x90(%rbp)
je     1484 <elf_hook+0x2f4>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
jmp    1610 <elf_hook+0x480>
movq   $0x0,-0x68(%rbp)
mov    -0x68(%rbp),%rax
cmp    -0x80(%rbp),%rax
jae    1605 <elf_hook+0x475>
mov    -0x60(%rbp),%rax
mov    -0x68(%rbp),%rcx
shl    $0x4,%rcx
add    %rcx,%rax
mov    0x8(%rax),%edi
call   1050 <ELF64_R_SYM@plt>
cmp    -0x70(%rbp),%rax
jne    15ef <elf_hook+0x45f>
mov    -0x18(%rbp),%rax
mov    -0x60(%rbp),%rcx
mov    -0x68(%rbp),%rdx
shl    $0x4,%rdx
add    %rdx,%rcx
add    (%rcx),%rax
mov    %rax,-0x88(%rbp)
cmpq   $0x0,-0x90(%rbp)
jne    1505 <elf_hook+0x375>
mov    -0x88(%rbp),%rax
mov    (%rax),%rax
mov    -0x88(%rbp),%rcx
add    %rcx,%rax
add    $0x8,%rax
mov    %rax,-0x90(%rbp)
mov    -0x88(%rbp),%rdi
mov    0x2b5d(%rip),%rax
sub    $0x1,%rax
xor    $0xffffffffffffffff,%rax
and    %rax,%rdi
mov    0x2b4b(%rip),%rsi
mov    0x2acc(%rip),%rax
mov    (%rax),%edx
mov    0x2a7b(%rip),%rax
or     (%rax),%edx
call   1080 <mprotect@plt>
mov    0x2a75(%rip),%rax
cmpq   $0x0,(%rax)
je     155a <elf_hook+0x3ca>
movq   $0x0,-0x8(%rbp)
jmp    1610 <elf_hook+0x480>
mov    -0x28(%rbp),%rcx
mov    -0x88(%rbp),%rax
sub    %rax,%rcx
sub    $0x8,%rcx
mov    -0x88(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x88(%rbp),%rdi
mov    0x2aec(%rip),%rax
sub    $0x1,%rax
xor    $0xffffffffffffffff,%rax
and    %rax,%rdi
mov    0x2ada(%rip),%rsi
mov    0x2a5b(%rip),%rax
mov    (%rax),%edx
mov    0x2a22(%rip),%rax
or     (%rax),%edx
call   1080 <mprotect@plt>
mov    0x2a04(%rip),%rax
cmpq   $0x0,(%rax)
je     15ea <elf_hook+0x45a>
mov    -0x90(%rbp),%rcx
mov    -0x88(%rbp),%rax
sub    %rax,%rcx
sub    $0x8,%rcx
mov    -0x88(%rbp),%rax
mov    %rcx,(%rax)
movq   $0x0,-0x8(%rbp)
jmp    1610 <elf_hook+0x480>
jmp    15ef <elf_hook+0x45f>
jmp    15f4 <elf_hook+0x464>
mov    -0x68(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x68(%rbp)
jmp    148c <elf_hook+0x2fc>
mov    -0x90(%rbp),%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x90,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<elf_hook>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x38,%rsp
movq   $0x0,0x10(%rsp)
movq   $0x0,0x28(%rsp)
movq   $0x0,0x8(%rsp)
movq   $0x0,0x20(%rsp)
xor    %r12d,%r12d
test   %rsi,%rsi
je     12c0 <elf_hook+0x130>
mov    %rdx,%rbx
test   %rdx,%rdx
je     12c0 <elf_hook+0x130>
mov    %rcx,%r14
test   %rcx,%rcx
je     12c0 <elf_hook+0x130>
mov    %rsi,%r15
mov    %rdi,%rbp
cmpq   $0x0,0x2e7c(%rip)
jne    120b <elf_hook+0x7b>
mov    0x2dd3(%rip),%rax
mov    (%rax),%edi
call   10a0 <sysconf@plt>
mov    %rax,0x2e65(%rip)
mov    0x2dce(%rip),%rax
mov    (%rax),%esi
mov    %rbp,%rdi
call   1090 <open@plt>
test   %eax,%eax
js     12bd <elf_hook+0x12d>
mov    %eax,%ebp
mov    0x2dab(%rip),%rax
mov    (%rax),%esi
lea    0x10(%rsp),%rdx
mov    %ebp,%edi
call   10b0 <section_by_type@plt>
test   %rax,%rax
jne    128e <elf_hook+0xfe>
mov    0x10(%rsp),%rsi
lea    0x20(%rsp),%rcx
lea    0x30(%rsp),%r8
mov    %ebp,%edi
mov    %rbx,%rdx
call   1060 <symbol_by_name@plt>
test   %rax,%rax
jne    128e <elf_hook+0xfe>
lea    0xd9b(%rip),%rsi
lea    0x28(%rsp),%rdx
mov    %ebp,%edi
call   1070 <section_by_name@plt>
test   %rax,%rax
jne    128e <elf_hook+0xfe>
lea    0xd8d(%rip),%rsi
lea    0x8(%rsp),%rdx
mov    %ebp,%edi
call   1070 <section_by_name@plt>
test   %rax,%rax
je     12d2 <elf_hook+0x142>
mov    0x10(%rsp),%rdi
call   1030 <free@plt>
mov    0x28(%rsp),%rdi
call   1030 <free@plt>
mov    0x8(%rsp),%rdi
call   1030 <free@plt>
mov    0x20(%rsp),%rdi
call   1030 <free@plt>
mov    %ebp,%edi
call   1040 <close@plt>
xor    %r12d,%r12d
mov    %r12,%rax
add    $0x38,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x10(%rsp),%rdi
call   1030 <free@plt>
mov    0x20(%rsp),%rdi
call   1030 <free@plt>
mov    0x28(%rsp),%rdi
mov    0x8(%rdi),%rbx
add    %r15,%rbx
movslq (%rdi),%r12
mov    0x8(%rsp),%rax
mov    0x8(%rax),%r13
add    %r15,%r13
movslq (%rax),%rax
mov    %rax,0x18(%rsp)
call   1030 <free@plt>
mov    0x8(%rsp),%rdi
call   1030 <free@plt>
mov    %ebp,%edi
call   1040 <close@plt>
cmp    $0x10,%r12
jb     139d <elf_hook+0x20d>
shr    $0x4,%r12
cmp    $0x2,%r12
mov    $0x1,%ebp
cmovae %r12,%rbp
add    $0x8,%rbx
mov    (%rbx),%edi
call   1050 <ELF64_R_SYM@plt>
cmp    0x30(%rsp),%rax
je     1354 <elf_hook+0x1c4>
add    $0x10,%rbx
add    $0xffffffffffffffff,%rbp
jne    133a <elf_hook+0x1aa>
jmp    139d <elf_hook+0x20d>
mov    -0x8(%rbx),%rbx
lea    (%rbx,%r15,1),%rax
mov    (%rbx,%r15,1),%r12
mov    0x2d09(%rip),%rsi
mov    0x2c8a(%rip),%rcx
mov    0x2c3b(%rip),%rdx
mov    (%rdx),%edx
or     (%rcx),%edx
mov    %rsi,%rdi
neg    %rdi
and    %rax,%rdi
mov    0x2c3f(%rip),%rax
or     (%rax),%edx
call   1080 <mprotect@plt>
mov    %r14,(%rbx,%r15,1)
test   %r12,%r12
jne    12c0 <elf_hook+0x130>
mov    0x18(%rsp),%rax
cmp    $0x10,%eax
jb     12bd <elf_hook+0x12d>
shr    $0x4,%rax
add    $0xfffffffffffffff8,%r14
cmp    $0x2,%rax
mov    $0x1,%ebp
cmovae %rax,%rbp
add    $0x8,%r13
xor    %r12d,%r12d
jmp    13d7 <elf_hook+0x247>
add    $0x10,%r13
add    $0xffffffffffffffff,%rbp
je     12c0 <elf_hook+0x130>
mov    0x0(%r13),%edi
call   1050 <ELF64_R_SYM@plt>
cmp    0x30(%rsp),%rax
jne    13c9 <elf_hook+0x239>
mov    %r13,0x18(%rsp)
mov    -0x8(%r13),%rbx
add    %r15,%rbx
test   %r12,%r12
jne    1403 <elf_hook+0x273>
mov    (%rbx),%rax
lea    (%rbx,%rax,1),%r12
add    $0x8,%r12
mov    0x2c66(%rip),%rsi
mov    %rsi,%rdi
neg    %rdi
and    %rbx,%rdi
mov    0x2b96(%rip),%rax
mov    (%rax),%edx
mov    0x2bd5(%rip),%r13
or     0x0(%r13),%edx
call   1080 <mprotect@plt>
mov    0x2b85(%rip),%rax
cmpq   $0x0,(%rax)
jne    12bd <elf_hook+0x12d>
mov    %r14,%rax
sub    %rbx,%rax
mov    %rax,(%rbx)
mov    0x2c23(%rip),%rsi
mov    %rsi,%rdi
neg    %rdi
and    %rbx,%rdi
mov    0x2b6b(%rip),%rax
mov    (%rax),%edx
or     0x0(%r13),%edx
call   1080 <mprotect@plt>
mov    0x2b49(%rip),%rax
cmpq   $0x0,(%rax)
jne    147f <elf_hook+0x2ef>
mov    0x18(%rsp),%r13
jmp    13c9 <elf_hook+0x239>
sub    %rbx,%r12
add    $0xfffffffffffffff8,%r12
mov    %r12,(%rbx)
jmp    12bd <elf_hook+0x12d>

LLVM IR (-O0):
%struct.TYPE_9__ = type { i32, i64 }
%struct.TYPE_10__ = type { i64, i32 }
@elf_hook.pagesize = internal global i64 0
@_SC_PAGESIZE = global i32 0
@O_RDONLY = global i32 0
@SHT_DYNSYM = global i32 0
@.str = [10 x i8] c".rela.plt\00"
@.str.1 = [10 x i8] c".rela.dyn\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@errno = global i64 0
define i8* @elf_hook(i8* %0, i8* %1, i8* %2, i8* %3) {
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i32
%11 = alloca %struct.TYPE_9__*
%12 = alloca %struct.TYPE_9__*
%13 = alloca %struct.TYPE_9__*
%14 = alloca %struct.TYPE_9__*
%15 = alloca %struct.TYPE_10__*
%16 = alloca %struct.TYPE_10__*
%17 = alloca i64
%18 = alloca i64
%19 = alloca i64
%20 = alloca i64
%21 = alloca i64*
%22 = alloca i8*
store i8* %0, i8** %6
store i8* %1, i8** %7
store i8* %2, i8** %8
store i8* %3, i8** %9
store %struct.TYPE_9__* null, %struct.TYPE_9__** %11
store %struct.TYPE_9__* null, %struct.TYPE_9__** %12
store %struct.TYPE_9__* null, %struct.TYPE_9__** %13
store %struct.TYPE_9__* null, %struct.TYPE_9__** %14
store %struct.TYPE_10__* null, %struct.TYPE_10__** %15
store %struct.TYPE_10__* null, %struct.TYPE_10__** %16
store i64* null, i64** %21
store i8* null, i8** %22
%23 = load i8*, i8** %7
%24 = icmp eq i8* null, %23
br i1 %24, label %31, label %25
25: ; preds = %4
%26 = load i8*, i8** %8
%27 = icmp eq i8* null, %26
br i1 %27, label %31, label %28
28: ; preds = %25
%29 = load i8*, i8** %9
%30 = icmp eq i8* null, %29
br i1 %30, label %31, label %33
31: ; preds = %28, %25, %4
%32 = load i8*, i8** %22
store i8* %32, i8** %5
br label %252
33: ; preds = %28
%34 = load i64, i64* @elf_hook.pagesize
%35 = icmp ne i64 %34, 0
br i1 %35, label %39, label %36
36: ; preds = %33
%37 = load i32, i32* @_SC_PAGESIZE
%38 = call i64 @sysconf(i32 %37)
store i64 %38, i64* @elf_hook.pagesize
br label %39
39: ; preds = %36, %33
%40 = load i8*, i8** %6
%41 = load i32, i32* @O_RDONLY
%42 = call i32 @open(i8* %40, i32 %41)
store i32 %42, i32* %10
%43 = load i32, i32* %10
%44 = icmp slt i32 %43, 0
br i1 %44, label %45, label %47
45: ; preds = %39
%46 = load i8*, i8** %22
store i8* %46, i8** %5
br label %252
47: ; preds = %39
%48 = load i32, i32* %10
%49 = load i32, i32* @SHT_DYNSYM
%50 = call i64 @section_by_type(i32 %48, i32 %49, %struct.TYPE_9__** %11)
%51 = icmp ne i64 %50, 0
br i1 %51, label %66, label %52
52: ; preds = %47
%53 = load i32, i32* %10
%54 = load %struct.TYPE_9__*, %struct.TYPE_9__** %11
%55 = load i8*, i8** %8
%56 = call i64 @symbol_by_name(i32 %53, %struct.TYPE_9__* %54, i8* %55, %struct.TYPE_9__** %14, i64* %18)
%57 = icmp ne i64 %56, 0
br i1 %57, label %66, label %58
58: ; preds = %52
%59 = load i32, i32* %10
%60 = call i64 @section_by_name(i32 %59, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), %struct.TYPE_9__** %12)
%61 = icmp ne i64 %60, 0
br i1 %61, label %66, label %62
62: ; preds = %58
%63 = load i32, i32* %10
%64 = call i64 @section_by_name(i32 %63, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0), %struct.TYPE_9__** %13)
%65 = icmp ne i64 %64, 0
br i1 %65, label %66, label %78
66: ; preds = %62, %58, %52, %47
%67 = load %struct.TYPE_9__*, %struct.TYPE_9__** %11
%68 = call i32 @free(%struct.TYPE_9__* %67)
%69 = load %struct.TYPE_9__*, %struct.TYPE_9__** %12
%70 = call i32 @free(%struct.TYPE_9__* %69)
%71 = load %struct.TYPE_9__*, %struct.TYPE_9__** %13
%72 = call i32 @free(%struct.TYPE_9__* %71)
%73 = load %struct.TYPE_9__*, %struct.TYPE_9__** %14
%74 = call i32 @free(%struct.TYPE_9__* %73)
%75 = load i32, i32* %10
%76 = call i32 @close(i32 %75)
%77 = load i8*, i8** %22
store i8* %77, i8** %5
br label %252
78: ; preds = %62
%79 = load %struct.TYPE_9__*, %struct.TYPE_9__** %11
%80 = call i32 @free(%struct.TYPE_9__* %79)
%81 = load %struct.TYPE_9__*, %struct.TYPE_9__** %14
%82 = call i32 @free(%struct.TYPE_9__* %81)
%83 = load i8*, i8** %7
%84 = ptrtoint i8* %83 to i64
%85 = load %struct.TYPE_9__*, %struct.TYPE_9__** %12
%86 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %85, i32 0, i32 1
%87 = load i64, i64* %86
%88 = add i64 %84, %87
%89 = inttoptr i64 %88 to %struct.TYPE_10__*
store %struct.TYPE_10__* %89, %struct.TYPE_10__** %15
%90 = load %struct.TYPE_9__*, %struct.TYPE_9__** %12
%91 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %90, i32 0, i32 0
%92 = load i32, i32* %91
%93 = sext i32 %92 to i64
%94 = udiv i64 %93, 16
store i64 %94, i64* %19
%95 = load i8*, i8** %7
%96 = ptrtoint i8* %95 to i64
%97 = load %struct.TYPE_9__*, %struct.TYPE_9__** %13
%98 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %97, i32 0, i32 1
%99 = load i64, i64* %98
%100 = add i64 %96, %99
%101 = inttoptr i64 %100 to %struct.TYPE_10__*
store %struct.TYPE_10__* %101, %struct.TYPE_10__** %16
%102 = load %struct.TYPE_9__*, %struct.TYPE_9__** %13
%103 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %102, i32 0, i32 0
%104 = load i32, i32* %103
%105 = sext i32 %104 to i64
%106 = udiv i64 %105, 16
store i64 %106, i64* %20
%107 = load %struct.TYPE_9__*, %struct.TYPE_9__** %12
%108 = call i32 @free(%struct.TYPE_9__* %107)
%109 = load %struct.TYPE_9__*, %struct.TYPE_9__** %13
%110 = call i32 @free(%struct.TYPE_9__* %109)
%111 = load i32, i32* %10
%112 = call i32 @close(i32 %111)
store i64 0, i64* %17
br label %113
113: ; preds = %157, %78
%114 = load i64, i64* %17
%115 = load i64, i64* %19
%116 = icmp ult i64 %114, %115
br i1 %116, label %117, label %160
117: ; preds = %113
%118 = load %struct.TYPE_10__*, %struct.TYPE_10__** %15
%119 = load i64, i64* %17
%120 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %118, i64 %119
%121 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %120, i32 0, i32 1
%122 = load i32, i32* %121
%123 = call i64 @ELF64_R_SYM(i32 %122)
%124 = load i64, i64* %18
%125 = icmp eq i64 %123, %124
br i1 %125, label %126, label %156
126: ; preds = %117
%127 = load i8*, i8** %7
%128 = ptrtoint i8* %127 to i64
%129 = load %struct.TYPE_10__*, %struct.TYPE_10__** %15
%130 = load i64, i64* %17
%131 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %129, i64 %130
%132 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %131, i32 0, i32 0
%133 = load i64, i64* %132
%134 = add i64 %128, %133
%135 = inttoptr i64 %134 to i64*
store i64* %135, i64** %21
%136 = load i64*, i64** %21
%137 = load i64, i64* %136
%138 = inttoptr i64 %137 to i8*
store i8* %138, i8** %22
%139 = load i64*, i64** %21
%140 = ptrtoint i64* %139 to i64
%141 = load i64, i64* @elf_hook.pagesize
%142 = sub i64 %141, 1
%143 = xor i64 -1, %142
%144 = and i64 %140, %143
%145 = inttoptr i64 %144 to i8*
%146 = load i64, i64* @elf_hook.pagesize
%147 = load i32, i32* @PROT_READ
%148 = load i32, i32* @PROT_WRITE
%149 = or i32 %147, %148
%150 = load i32, i32* @PROT_EXEC
%151 = or i32 %149, %150
%152 = call i32 @mprotect(i8* %145, i64 %146, i32 %151)
%153 = load i8*, i8** %9
%154 = ptrtoint i8* %153 to i64
%155 = load i64*, i64** %21
store i64 %154, i64* %155
br label %160
156: ; preds = %117
br label %157
157: ; preds = %156
%158 = load i64, i64* %17
%159 = add i64 %158, 1
store i64 %159, i64* %17
br label %113
160: ; preds = %126, %113
%161 = load i8*, i8** %22
%162 = icmp ne i8* %161, null
br i1 %162, label %163, label %165
163: ; preds = %160
%164 = load i8*, i8** %22
store i8* %164, i8** %5
br label %252
165: ; preds = %160
store i64 0, i64* %17
br label %166
166: ; preds = %247, %165
%167 = load i64, i64* %17
%168 = load i64, i64* %20
%169 = icmp ult i64 %167, %168
br i1 %169, label %170, label %250
170: ; preds = %166
%171 = load %struct.TYPE_10__*, %struct.TYPE_10__** %16
%172 = load i64, i64* %17
%173 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %171, i64 %172
%174 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %173, i32 0, i32 1
%175 = load i32, i32* %174
%176 = call i64 @ELF64_R_SYM(i32 %175)
%177 = load i64, i64* %18
%178 = icmp eq i64 %176, %177
br i1 %178, label %179, label %246
179: ; preds = %170
%180 = load i8*, i8** %7
%181 = ptrtoint i8* %180 to i64
%182 = load %struct.TYPE_10__*, %struct.TYPE_10__** %16
%183 = load i64, i64* %17
%184 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %182, i64 %183
%185 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %184, i32 0, i32 0
%186 = load i64, i64* %185
%187 = add i64 %181, %186
%188 = inttoptr i64 %187 to i64*
store i64* %188, i64** %21
%189 = load i8*, i8** %22
%190 = icmp ne i8* %189, null
br i1 %190, label %199, label %191
191: ; preds = %179
%192 = load i64*, i64** %21
%193 = load i64, i64* %192
%194 = load i64*, i64** %21
%195 = ptrtoint i64* %194 to i64
%196 = add i64 %193, %195
%197 = add i64 %196, 8
%198 = inttoptr i64 %197 to i8*
store i8* %198, i8** %22
br label %199
199: ; preds = %191, %179
%200 = load i64*, i64** %21
%201 = ptrtoint i64* %200 to i64
%202 = load i64, i64* @elf_hook.pagesize
%203 = sub i64 %202, 1
%204 = xor i64 -1, %203
%205 = and i64 %201, %204
%206 = inttoptr i64 %205 to i8*
%207 = load i64, i64* @elf_hook.pagesize
%208 = load i32, i32* @PROT_READ
%209 = load i32, i32* @PROT_WRITE
%210 = or i32 %208, %209
%211 = call i32 @mprotect(i8* %206, i64 %207, i32 %210)
%212 = load i64, i64* @errno
%213 = icmp ne i64 %212, 0
br i1 %213, label %214, label %215
214: ; preds = %199
store i8* null, i8** %5
br label %252
215: ; preds = %199
%216 = load i8*, i8** %9
%217 = ptrtoint i8* %216 to i64
%218 = load i64*, i64** %21
%219 = ptrtoint i64* %218 to i64
%220 = sub i64 %217, %219
%221 = sub i64 %220, 8
%222 = load i64*, i64** %21
store i64 %221, i64* %222
%223 = load i64*, i64** %21
%224 = ptrtoint i64* %223 to i64
%225 = load i64, i64* @elf_hook.pagesize
%226 = sub i64 %225, 1
%227 = xor i64 -1, %226
%228 = and i64 %224, %227
%229 = inttoptr i64 %228 to i8*
%230 = load i64, i64* @elf_hook.pagesize
%231 = load i32, i32* @PROT_READ
%232 = load i32, i32* @PROT_EXEC
%233 = or i32 %231, %232
%234 = call i32 @mprotect(i8* %229, i64 %230, i32 %233)
%235 = load i64, i64* @errno
%236 = icmp ne i64 %235, 0
br i1 %236, label %237, label %245
237: ; preds = %215
%238 = load i8*, i8** %22
%239 = ptrtoint i8* %238 to i64
%240 = load i64*, i64** %21
%241 = ptrtoint i64* %240 to i64
%242 = sub i64 %239, %241
%243 = sub i64 %242, 8
%244 = load i64*, i64** %21
store i64 %243, i64* %244
store i8* null, i8** %5
br label %252
245: ; preds = %215
br label %246
246: ; preds = %245, %170
br label %247
247: ; preds = %246
%248 = load i64, i64* %17
%249 = add i64 %248, 1
store i64 %249, i64* %17
br label %166
250: ; preds = %166
%251 = load i8*, i8** %22
store i8* %251, i8** %5
br label %252
252: ; preds = %250, %237, %214, %163, %66, %45, %31
%253 = load i8*, i8** %5
ret i8* %253
}

LLVM IR (-O2):
%struct.TYPE_9__ = type { i32, i64 }
%struct.TYPE_10__ = type { i64, i32 }
@elf_hook.pagesize = internal unnamed_addr global i64 0
@_SC_PAGESIZE = global i32 0
@O_RDONLY = global i32 0
@SHT_DYNSYM = global i32 0
@.str = [10 x i8] c".rela.plt\00"
@.str.1 = [10 x i8] c".rela.dyn\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@errno = global i64 0
define i8* @elf_hook(i8* nocapture %0, i8* %1, i8* %2, i8* %3) {
%5 = alloca %struct.TYPE_9__*
%6 = alloca %struct.TYPE_9__*
%7 = alloca %struct.TYPE_9__*
%8 = alloca %struct.TYPE_9__*
%9 = alloca i64
%10 = bitcast %struct.TYPE_9__** %5 to i8*
store %struct.TYPE_9__* null, %struct.TYPE_9__** %5
%11 = bitcast %struct.TYPE_9__** %6 to i8*
store %struct.TYPE_9__* null, %struct.TYPE_9__** %6
%12 = bitcast %struct.TYPE_9__** %7 to i8*
store %struct.TYPE_9__* null, %struct.TYPE_9__** %7
%13 = bitcast %struct.TYPE_9__** %8 to i8*
store %struct.TYPE_9__* null, %struct.TYPE_9__** %8
%14 = bitcast i64* %9 to i8*
%15 = icmp eq i8* %1, null
%16 = icmp eq i8* %2, null
%17 = or i1 %15, %16
%18 = icmp eq i8* %3, null
%19 = or i1 %17, %18
br i1 %19, label %172, label %20
20: ; preds = %4
%21 = load i64, i64* @elf_hook.pagesize
%22 = icmp eq i64 %21, 0
br i1 %22, label %23, label %26
23: ; preds = %20
%24 = load i32, i32* @_SC_PAGESIZE
%25 = tail call i64 @sysconf(i32 %24)
store i64 %25, i64* @elf_hook.pagesize
br label %26
26: ; preds = %23, %20
%27 = load i32, i32* @O_RDONLY
%28 = tail call i32 @open(i8* %0, i32 %27)
%29 = icmp slt i32 %28, 0
br i1 %29, label %172, label %30
30: ; preds = %26
%31 = load i32, i32* @SHT_DYNSYM
%32 = call i64 @section_by_type(i32 %28, i32 %31, %struct.TYPE_9__** %5)
%33 = icmp eq i64 %32, 0
br i1 %33, label %34, label %44
34: ; preds = %30
%35 = load %struct.TYPE_9__*, %struct.TYPE_9__** %5
%36 = call i64 @symbol_by_name(i32 %28, %struct.TYPE_9__* %35, i8* %2, %struct.TYPE_9__** %8, i64* %9)
%37 = icmp eq i64 %36, 0
br i1 %37, label %38, label %44
38: ; preds = %34
%39 = call i64 @section_by_name(i32 %28, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), %struct.TYPE_9__** %6)
%40 = icmp eq i64 %39, 0
br i1 %40, label %41, label %44
41: ; preds = %38
%42 = call i64 @section_by_name(i32 %28, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0), %struct.TYPE_9__** %7)
%43 = icmp eq i64 %42, 0
br i1 %43, label %54, label %44
44: ; preds = %41, %38, %34, %30
%45 = load %struct.TYPE_9__*, %struct.TYPE_9__** %5
%46 = call i32 @free(%struct.TYPE_9__* %45)
%47 = load %struct.TYPE_9__*, %struct.TYPE_9__** %6
%48 = call i32 @free(%struct.TYPE_9__* %47)
%49 = load %struct.TYPE_9__*, %struct.TYPE_9__** %7
%50 = call i32 @free(%struct.TYPE_9__* %49)
%51 = load %struct.TYPE_9__*, %struct.TYPE_9__** %8
%52 = call i32 @free(%struct.TYPE_9__* %51)
%53 = call i32 @close(i32 %28)
br label %172
54: ; preds = %41
%55 = load %struct.TYPE_9__*, %struct.TYPE_9__** %5
%56 = call i32 @free(%struct.TYPE_9__* %55)
%57 = load %struct.TYPE_9__*, %struct.TYPE_9__** %8
%58 = call i32 @free(%struct.TYPE_9__* %57)
%59 = ptrtoint i8* %1 to i64
%60 = load %struct.TYPE_9__*, %struct.TYPE_9__** %6
%61 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %60, i64 0, i32 1
%62 = load i64, i64* %61
%63 = add i64 %62, %59
%64 = inttoptr i64 %63 to %struct.TYPE_10__*
%65 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %60, i64 0, i32 0
%66 = load i32, i32* %65
%67 = load %struct.TYPE_9__*, %struct.TYPE_9__** %7
%68 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %67, i64 0, i32 1
%69 = load i64, i64* %68
%70 = add i64 %69, %59
%71 = inttoptr i64 %70 to %struct.TYPE_10__*
%72 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %67, i64 0, i32 0
%73 = load i32, i32* %72
%74 = sext i32 %73 to i64
%75 = lshr i64 %74, 4
%76 = call i32 @free(%struct.TYPE_9__* %60)
%77 = load %struct.TYPE_9__*, %struct.TYPE_9__** %7
%78 = call i32 @free(%struct.TYPE_9__* %77)
%79 = call i32 @close(i32 %28)
%80 = icmp ult i32 %66, 16
br i1 %80, label %114, label %81
81: ; preds = %54
%82 = sext i32 %66 to i64
%83 = lshr i64 %82, 4
%84 = call i64 @llvm.umax.i64(i64 %83, i64 1)
br label %85
85: ; preds = %81, %92
%86 = phi i64 [ %93, %92 ], [ 0, %81 ]
%87 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %64, i64 %86, i32 1
%88 = load i32, i32* %87
%89 = call i64 @ELF64_R_SYM(i32 %88)
%90 = load i64, i64* %9
%91 = icmp eq i64 %89, %90
br i1 %91, label %95, label %92
92: ; preds = %85
%93 = add nuw nsw i64 %86, 1
%94 = icmp eq i64 %93, %84
br i1 %94, label %114, label %85
95: ; preds = %85
%96 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %64, i64 %86, i32 0
%97 = load i64, i64* %96
%98 = add i64 %97, %59
%99 = inttoptr i64 %98 to i64*
%100 = load i64, i64* %99
%101 = inttoptr i64 %100 to i8*
%102 = load i64, i64* @elf_hook.pagesize
%103 = sub i64 0, %102
%104 = and i64 %98, %103
%105 = inttoptr i64 %104 to i8*
%106 = load i32, i32* @PROT_READ
%107 = load i32, i32* @PROT_WRITE
%108 = or i32 %107, %106
%109 = load i32, i32* @PROT_EXEC
%110 = or i32 %108, %109
%111 = call i32 @mprotect(i8* %105, i64 %102, i32 %110)
%112 = ptrtoint i8* %3 to i64
store i64 %112, i64* %99
%113 = icmp eq i64 %100, 0
br i1 %113, label %114, label %172
114: ; preds = %92, %54, %95
%115 = icmp ult i32 %73, 16
br i1 %115, label %172, label %116
116: ; preds = %114
%117 = ptrtoint i8* %3 to i64
%118 = add i64 %117, -8
%119 = call i64 @llvm.umax.i64(i64 %75, i64 1)
br label %120
120: ; preds = %116, %168
%121 = phi i8* [ null, %116 ], [ %169, %168 ]
%122 = phi i64 [ 0, %116 ], [ %170, %168 ]
%123 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %71, i64 %122, i32 1
%124 = load i32, i32* %123
%125 = call i64 @ELF64_R_SYM(i32 %124)
%126 = load i64, i64* %9
%127 = icmp eq i64 %125, %126
br i1 %127, label %128, label %168
128: ; preds = %120
%129 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %71, i64 %122, i32 0
%130 = load i64, i64* %129
%131 = add i64 %130, %59
%132 = inttoptr i64 %131 to i64*
%133 = icmp eq i8* %121, null
br i1 %133, label %134, label %139
134: ; preds = %128
%135 = load i64, i64* %132
%136 = add i64 %131, 8
%137 = add i64 %136, %135
%138 = inttoptr i64 %137 to i8*
br label %139
139: ; preds = %134, %128
%140 = phi i8* [ %121, %128 ], [ %138, %134 ]
%141 = load i64, i64* @elf_hook.pagesize
%142 = sub i64 0, %141
%143 = and i64 %131, %142
%144 = inttoptr i64 %143 to i8*
%145 = load i32, i32* @PROT_READ
%146 = load i32, i32* @PROT_WRITE
%147 = or i32 %146, %145
%148 = call i32 @mprotect(i8* %144, i64 %141, i32 %147)
%149 = load i64, i64* @errno
%150 = icmp eq i64 %149, 0
br i1 %150, label %151, label %172
151: ; preds = %139
%152 = sub i64 %118, %131
store i64 %152, i64* %132
%153 = load i64, i64* @elf_hook.pagesize
%154 = sub i64 0, %153
%155 = and i64 %131, %154
%156 = inttoptr i64 %155 to i8*
%157 = load i32, i32* @PROT_READ
%158 = load i32, i32* @PROT_EXEC
%159 = or i32 %158, %157
%160 = call i32 @mprotect(i8* %156, i64 %153, i32 %159)
%161 = load i64, i64* @errno
%162 = icmp eq i64 %161, 0
br i1 %162, label %168, label %163
163: ; preds = %151
%164 = inttoptr i64 %131 to i64*
%165 = ptrtoint i8* %140 to i64
%166 = sub i64 -8, %131
%167 = add i64 %166, %165
store i64 %167, i64* %164
br label %172
168: ; preds = %120, %151
%169 = phi i8* [ %140, %151 ], [ %121, %120 ]
%170 = add nuw nsw i64 %122, 1
%171 = icmp eq i64 %170, %119
br i1 %171, label %172, label %120
172: ; preds = %139, %168, %114, %95, %26, %4, %163, %44
%173 = phi i8* [ null, %44 ], [ null, %163 ], [ null, %4 ], [ null, %26 ], [ %101, %95 ], [ null, %114 ], [ null, %139 ], [ %169, %168 ]
ret i8* %173
}