#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ ChangeMemPermissions(void *, int);
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ fgets(char *, int, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ sscanf(char *, char *, ...);
int /*<<< orphan*/ stdin;
int strlen(char *);
void patch(void) {
  char str[17], ptc[256] = {0};
  uintptr_t *trgt = NULL;
  unsigned char patch[256];
  char *pos = ptc;
  size_t count = 0;
  printf("\t[pa] Target Address: ");
  fgets(str, 17, stdin);
  sscanf(str, "%p", &trgt);
  printf("\t[pa] Opcodes: ");
  fgets(ptc, 256, stdin);
  for (count = 0; count < strlen(ptc) / 2; count++) {
    sscanf(pos, "%2hhx", &patch[count]);
    pos += 2;
  }
  if (trgt == NULL) {
    printf("\t[!] Target address may not be null or zero\n");
    return;
  }
  if (ChangeMemPermissions((void *)trgt, PROT_READ | PROT_WRITE | PROT_EXEC) !=
      0) {
    printf("\t[!] Unable to adjust memory permissions at %016lx\n", trgt);
    return;
  }
  char *pl = (char *)trgt;
  for (count = 0; count < strlen(ptc) / 2; count++) {
    pl[count] = patch[count];
  }
  if (ChangeMemPermissions((void *)trgt, PROT_READ | PROT_EXEC) != 0) {
    printf("\t[!] Unable to fix memory permissions at %016lx\n", trgt);
  }
}


x86 assembly (clang, -O0):
<patch>:
push   %rbp
mov    %rsp,%rbp
sub    $0x260,%rsp
lea    -0x120(%rbp),%rdi
xor    %esi,%esi
mov    $0x100,%edx
call   1060 <memset@plt>
movq   $0x0,-0x128(%rbp)
lea    -0x120(%rbp),%rax
mov    %rax,-0x238(%rbp)
movq   $0x0,-0x240(%rbp)
lea    0xe57(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    -0x20(%rbp),%rdi
mov    0x2e25(%rip),%rax
mov    (%rax),%edx
mov    $0x11,%esi
call   1070 <fgets@plt>
lea    -0x20(%rbp),%rdi
lea    0xe45(%rip),%rsi
lea    -0x128(%rbp),%rdx
mov    $0x0,%al
call   1080 <sscanf@plt>
lea    0xe33(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    -0x120(%rbp),%rdi
mov    0x2de4(%rip),%rax
mov    (%rax),%edx
mov    $0x100,%esi
call   1070 <fgets@plt>
movq   $0x0,-0x240(%rbp)
mov    -0x240(%rbp),%rax
mov    %rax,-0x250(%rbp)
lea    -0x120(%rbp),%rdi
call   1040 <strlen@plt>
mov    $0x2,%ecx
cltd
idiv   %ecx
mov    %eax,%ecx
mov    -0x250(%rbp),%rax
movslq %ecx,%rcx
cmp    %rcx,%rax
jae    1296 <patch+0x136>
mov    -0x238(%rbp),%rdi
lea    -0x230(%rbp),%rdx
add    -0x240(%rbp),%rdx
lea    0xdc4(%rip),%rsi
mov    $0x0,%al
call   1080 <sscanf@plt>
mov    -0x238(%rbp),%rax
add    $0x2,%rax
mov    %rax,-0x238(%rbp)
mov    -0x240(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x240(%rbp)
jmp    1213 <patch+0xb3>
cmpq   $0x0,-0x128(%rbp)
jne    12b7 <patch+0x157>
lea    0xd85(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
jmp    13c5 <patch+0x265>
mov    -0x128(%rbp),%rdi
mov    0x2d33(%rip),%rax
mov    (%rax),%esi
mov    0x2cfa(%rip),%rax
or     (%rax),%esi
mov    0x2d01(%rip),%rax
or     (%rax),%esi
call   1030 <ChangeMemPermissions@plt>
cmp    $0x0,%rax
je     1302 <patch+0x1a2>
mov    -0x128(%rbp),%rsi
lea    0xd67(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
jmp    13c5 <patch+0x265>
mov    -0x128(%rbp),%rax
mov    %rax,-0x248(%rbp)
movq   $0x0,-0x240(%rbp)
mov    -0x240(%rbp),%rax
mov    %rax,-0x258(%rbp)
lea    -0x120(%rbp),%rdi
call   1040 <strlen@plt>
mov    $0x2,%ecx
cltd
idiv   %ecx
mov    %eax,%ecx
mov    -0x258(%rbp),%rax
movslq %ecx,%rcx
cmp    %rcx,%rax
jae    1388 <patch+0x228>
mov    -0x240(%rbp),%rax
mov    -0x230(%rbp,%rax,1),%dl
mov    -0x248(%rbp),%rax
mov    -0x240(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x240(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x240(%rbp)
jmp    131b <patch+0x1bb>
mov    -0x128(%rbp),%rdi
mov    0x2c62(%rip),%rax
mov    (%rax),%esi
mov    0x2c39(%rip),%rax
or     (%rax),%esi
call   1030 <ChangeMemPermissions@plt>
cmp    $0x0,%rax
je     13c5 <patch+0x265>
mov    -0x128(%rbp),%rsi
lea    0xcd3(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
add    $0x260,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<patch>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x230,%rsp
xorps  %xmm0,%xmm0
movaps %xmm0,0x100(%rsp)
movaps %xmm0,0xf0(%rsp)
movaps %xmm0,0xe0(%rsp)
movaps %xmm0,0xd0(%rsp)
movaps %xmm0,0xc0(%rsp)
movaps %xmm0,0xb0(%rsp)
movaps %xmm0,0xa0(%rsp)
movaps %xmm0,0x90(%rsp)
movaps %xmm0,0x80(%rsp)
movaps %xmm0,0x70(%rsp)
movaps %xmm0,0x60(%rsp)
movaps %xmm0,0x50(%rsp)
movaps %xmm0,0x40(%rsp)
movaps %xmm0,0x30(%rsp)
movaps %xmm0,0x20(%rsp)
movaps %xmm0,0x10(%rsp)
movq   $0x0,0x8(%rsp)
lea    0xe12(%rip),%rdi
xor    %eax,%eax
call   1060 <printf@plt>
mov    0x2de4(%rip),%r14
mov    (%r14),%edx
lea    0x110(%rsp),%rbx
mov    %rbx,%rdi
mov    $0x11,%esi
call   1070 <fgets@plt>
lea    0xdfc(%rip),%rsi
lea    0x8(%rsp),%rdx
mov    %rbx,%rdi
xor    %eax,%eax
call   1080 <sscanf@plt>
lea    0xde9(%rip),%rdi
xor    %eax,%eax
call   1060 <printf@plt>
mov    (%r14),%edx
lea    0x10(%rsp),%r14
mov    %r14,%rdi
mov    $0x100,%esi
call   1070 <fgets@plt>
mov    %r14,%rdi
call   1050 <strlen@plt>
add    $0x1,%eax
cmp    $0x3,%eax
jb     12a9 <patch+0x149>
lea    0xdc6(%rip),%r15
mov    %r14,%r12
xor    %ebx,%ebx
nopl   0x0(%rax)
lea    (%rsp,%rbx,1),%rdx
add    $0x130,%rdx
mov    %r12,%rdi
mov    %r15,%rsi
xor    %eax,%eax
call   1080 <sscanf@plt>
add    $0x2,%r12
add    $0x1,%rbx
mov    %r14,%rdi
call   1050 <strlen@plt>
mov    %eax,%ecx
shr    $0x1f,%ecx
add    %eax,%ecx
sar    %ecx
movslq %ecx,%rax
cmp    %rax,%rbx
jb     1270 <patch+0x110>
mov    0x8(%rsp),%rdi
test   %rdi,%rdi
je     12eb <patch+0x18b>
mov    0x2d3e(%rip),%r14
mov    0x2d07(%rip),%rax
mov    (%rax),%esi
or     (%r14),%esi
mov    0x2d0b(%rip),%r15
or     (%r15),%esi
call   1040 <ChangeMemPermissions@plt>
test   %rax,%rax
je     12f9 <patch+0x199>
mov    0x8(%rsp),%rsi
lea    0xd4a(%rip),%rdi
jmp    136b <patch+0x20b>
lea    0xda3(%rip),%rdi
call   1030 <puts@plt>
jmp    1372 <patch+0x212>
mov    0x8(%rsp),%r13
lea    0x10(%rsp),%rdi
call   1050 <strlen@plt>
add    $0x1,%eax
cmp    $0x3,%eax
jb     134a <patch+0x1ea>
xor    %ebx,%ebx
lea    0x10(%rsp),%r12
nopw   0x0(%rax,%rax,1)
movzbl 0x130(%rsp,%rbx,1),%eax
mov    %al,0x0(%r13,%rbx,1)
add    $0x1,%rbx
mov    %r12,%rdi
call   1050 <strlen@plt>
mov    %eax,%ecx
shr    $0x1f,%ecx
add    %eax,%ecx
sar    %ecx
movslq %ecx,%rax
cmp    %rax,%rbx
jb     1320 <patch+0x1c0>
mov    0x8(%rsp),%rdi
mov    (%r15),%esi
or     (%r14),%esi
call   1040 <ChangeMemPermissions@plt>
test   %rax,%rax
je     1372 <patch+0x212>
mov    0x8(%rsp),%rsi
lea    0xcf9(%rip),%rdi
xor    %eax,%eax
call   1060 <printf@plt>
add    $0x230,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [23 x i8] c"\09[pa] Target Address: \00"
@stdin = global i32 0
@.str.1 = [3 x i8] c"%p\00"
@.str.2 = [16 x i8] c"\09[pa] Opcodes: \00"
@.str.3 = [6 x i8] c"%2hhx\00"
@.str.4 = [45 x i8] c"\09[!] Target address may not be null or zero\0A\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@.str.5 = [52 x i8] c"\09[!] Unable to adjust memory permissions at %016lx\0A\00"
@.str.6 = [49 x i8] c"\09[!] Unable to fix memory permissions at %016lx\0A\00"
define void @patch() {
%1 = alloca [17 x i8]
%2 = alloca [256 x i8]
%3 = alloca i64*
%4 = alloca [256 x i8]
%5 = alloca i8*
%6 = alloca i64
%7 = alloca i8*
%8 = bitcast [256 x i8]* %2 to i8*
store i64* null, i64** %3
%9 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
store i8* %9, i8** %5
store i64 0, i64* %6
%10 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str, i64 0, i64 0))
%11 = getelementptr inbounds [17 x i8], [17 x i8]* %1, i64 0, i64 0
%12 = load i32, i32* @stdin
%13 = call i32 @fgets(i8* %11, i32 17, i32 %12)
%14 = getelementptr inbounds [17 x i8], [17 x i8]* %1, i64 0, i64 0
%15 = call i32 (i8*, i8*, ...) @sscanf(i8* %14, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i64** %3)
%16 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0))
%17 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%18 = load i32, i32* @stdin
%19 = call i32 @fgets(i8* %17, i32 256, i32 %18)
store i64 0, i64* %6
br label %20
20: ; preds = %34, %0
%21 = load i64, i64* %6
%22 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%23 = call i32 @strlen(i8* %22)
%24 = sdiv i32 %23, 2
%25 = sext i32 %24 to i64
%26 = icmp ult i64 %21, %25
br i1 %26, label %27, label %37
27: ; preds = %20
%28 = load i8*, i8** %5
%29 = load i64, i64* %6
%30 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 %29
%31 = call i32 (i8*, i8*, ...) @sscanf(i8* %28, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0), i8* %30)
%32 = load i8*, i8** %5
%33 = getelementptr inbounds i8, i8* %32, i64 2
store i8* %33, i8** %5
br label %34
34: ; preds = %27
%35 = load i64, i64* %6
%36 = add i64 %35, 1
store i64 %36, i64* %6
br label %20
37: ; preds = %20
%38 = load i64*, i64** %3
%39 = icmp eq i64* %38, null
br i1 %39, label %40, label %42
40: ; preds = %37
%41 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([45 x i8], [45 x i8]* @.str.4, i64 0, i64 0))
br label %86
42: ; preds = %37
%43 = load i64*, i64** %3
%44 = bitcast i64* %43 to i8*
%45 = load i32, i32* @PROT_READ
%46 = load i32, i32* @PROT_WRITE
%47 = or i32 %45, %46
%48 = load i32, i32* @PROT_EXEC
%49 = or i32 %47, %48
%50 = call i64 @ChangeMemPermissions(i8* %44, i32 %49)
%51 = icmp ne i64 %50, 0
br i1 %51, label %52, label %55
52: ; preds = %42
%53 = load i64*, i64** %3
%54 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([52 x i8], [52 x i8]* @.str.5, i64 0, i64 0), i64* %53)
br label %86
55: ; preds = %42
%56 = load i64*, i64** %3
%57 = bitcast i64* %56 to i8*
store i8* %57, i8** %7
store i64 0, i64* %6
br label %58
58: ; preds = %72, %55
%59 = load i64, i64* %6
%60 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%61 = call i32 @strlen(i8* %60)
%62 = sdiv i32 %61, 2
%63 = sext i32 %62 to i64
%64 = icmp ult i64 %59, %63
br i1 %64, label %65, label %75
65: ; preds = %58
%66 = load i64, i64* %6
%67 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 %66
%68 = load i8, i8* %67
%69 = load i8*, i8** %7
%70 = load i64, i64* %6
%71 = getelementptr inbounds i8, i8* %69, i64 %70
store i8 %68, i8* %71
br label %72
72: ; preds = %65
%73 = load i64, i64* %6
%74 = add i64 %73, 1
store i64 %74, i64* %6
br label %58
75: ; preds = %58
%76 = load i64*, i64** %3
%77 = bitcast i64* %76 to i8*
%78 = load i32, i32* @PROT_READ
%79 = load i32, i32* @PROT_EXEC
%80 = or i32 %78, %79
%81 = call i64 @ChangeMemPermissions(i8* %77, i32 %80)
%82 = icmp ne i64 %81, 0
br i1 %82, label %83, label %86
83: ; preds = %75
%84 = load i64*, i64** %3
%85 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([49 x i8], [49 x i8]* @.str.6, i64 0, i64 0), i64* %84)
br label %86
86: ; preds = %40, %52, %83, %75
ret void
}

LLVM IR (-O2):
@.str = [23 x i8] c"\09[pa] Target Address: \00"
@stdin = global i32 0
@.str.1 = [3 x i8] c"%p\00"
@.str.2 = [16 x i8] c"\09[pa] Opcodes: \00"
@.str.3 = [6 x i8] c"%2hhx\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@.str.5 = [52 x i8] c"\09[!] Unable to adjust memory permissions at %016lx\0A\00"
@.str.6 = [49 x i8] c"\09[!] Unable to fix memory permissions at %016lx\0A\00"
@str = [44 x i8] c"\09[!] Target address may not be null or zero\00"
define void @patch() {
%1 = alloca [17 x i8]
%2 = alloca [256 x i8]
%3 = alloca i64*
%4 = alloca [256 x i8]
%5 = getelementptr inbounds [17 x i8], [17 x i8]* %1, i64 0, i64 0
%6 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%7 = bitcast i64** %3 to i8*
store i64* null, i64** %3
%8 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 0
%9 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str, i64 0, i64 0))
%10 = load i32, i32* @stdin
%11 = call i32 @fgets(i8* %5, i32 17, i32 %10)
%12 = call i32 (i8*, i8*, ...) @sscanf(i8* %5, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i64** %3)
%13 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0))
%14 = load i32, i32* @stdin
%15 = call i32 @fgets(i8* %6, i32 256, i32 %14)
%16 = call i32 @strlen(i8* %6)
%17 = add i32 %16, 1
%18 = icmp ult i32 %17, 3
br i1 %18, label %30, label %19
19: ; preds = %0, %19
%20 = phi i8* [ %24, %19 ], [ %6, %0 ]
%21 = phi i64 [ %25, %19 ], [ 0, %0 ]
%22 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 %21
%23 = call i32 (i8*, i8*, ...) @sscanf(i8* %20, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0), i8* %22)
%24 = getelementptr inbounds i8, i8* %20, i64 2
%25 = add nuw i64 %21, 1
%26 = call i32 @strlen(i8* %6)
%27 = sdiv i32 %26, 2
%28 = sext i32 %27 to i64
%29 = icmp ult i64 %25, %28
br i1 %29, label %19, label %30
30: ; preds = %19, %0
%31 = load i64*, i64** %3
%32 = icmp eq i64* %31, null
br i1 %32, label %33, label %35
33: ; preds = %30
%34 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([44 x i8], [44 x i8]* @str, i64 0, i64 0))
br label %73
35: ; preds = %30
%36 = bitcast i64* %31 to i8*
%37 = load i32, i32* @PROT_READ
%38 = load i32, i32* @PROT_WRITE
%39 = or i32 %38, %37
%40 = load i32, i32* @PROT_EXEC
%41 = or i32 %39, %40
%42 = call i64 @ChangeMemPermissions(i8* %36, i32 %41)
%43 = icmp eq i64 %42, 0
br i1 %43, label %47, label %44
44: ; preds = %35
%45 = load i64*, i64** %3
%46 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([52 x i8], [52 x i8]* @.str.5, i64 0, i64 0), i64* %45)
br label %73
47: ; preds = %35
%48 = bitcast i64** %3 to i8**
%49 = load i8*, i8** %48
%50 = call i32 @strlen(i8* %6)
%51 = add i32 %50, 1
%52 = icmp ult i32 %51, 3
br i1 %52, label %63, label %53
53: ; preds = %47, %53
%54 = phi i64 [ %58, %53 ], [ 0, %47 ]
%55 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 %54
%56 = load i8, i8* %55
%57 = getelementptr inbounds i8, i8* %49, i64 %54
store i8 %56, i8* %57
%58 = add nuw i64 %54, 1
%59 = call i32 @strlen(i8* %6)
%60 = sdiv i32 %59, 2
%61 = sext i32 %60 to i64
%62 = icmp ult i64 %58, %61
br i1 %62, label %53, label %63
63: ; preds = %53, %47
%64 = load i8*, i8** %48
%65 = load i32, i32* @PROT_READ
%66 = load i32, i32* @PROT_EXEC
%67 = or i32 %66, %65
%68 = call i64 @ChangeMemPermissions(i8* %64, i32 %67)
%69 = icmp eq i64 %68, 0
br i1 %69, label %73, label %70
70: ; preds = %63
%71 = load i64*, i64** %3
%72 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([49 x i8], [49 x i8]* @.str.6, i64 0, i64 0), i64* %71)
br label %73
73: ; preds = %63, %70, %44, %33
ret void
}