#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ start;

/* Variables and functions */
int /*<<< orphan*/ STDOUT_FILENO;
scalar_t__ memcmp(char *, char *, int);
int /*<<< orphan*/ write(int /*<<< orphan*/, uintptr_t *, int);
void do_leak_baseaddress() {
  uintptr_t start = (uintptr_t)&do_leak_baseaddress;
  start &= ~(0x1000 - 1);
  while (memcmp((char *)start + 1, "ELF", 3))
    start -= 0x1000;
  write(STDOUT_FILENO, &start, sizeof(start));
}


x86 assembly (clang, -O0):
<do_leak_baseaddress>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    0x2ea9(%rip),%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
and    $0xfffffffffffff000,%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rdi
add    $0x1,%rdi
lea    0xeb0(%rip),%rsi
mov    $0x3,%edx
call   1040 <memcmp@plt>
cmp    $0x0,%rax
je     1177 <do_leak_baseaddress+0x57>
mov    -0x8(%rbp),%rax
sub    $0x1000,%rax
mov    %rax,-0x8(%rbp)
jmp    1141 <do_leak_baseaddress+0x21>
mov    0x2e72(%rip),%rax
mov    (%rax),%edi
lea    -0x8(%rbp),%rsi
mov    $0x8,%edx
call   1030 <write@plt>
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<do_leak_baseaddress>:
push   %r14
push   %rbx
push   %rax
mov    $0xfffffffffffff000,%rbx
and    0x2ea6(%rip),%rbx
lea    0xec7(%rip),%r14
nopl   0x0(%rax)
lea    0x1(%rbx),%rdi
mov    %r14,%rsi
mov    $0x3,%edx
call   1040 <memcmp@plt>
add    $0xfffffffffffff000,%rbx
test   %rax,%rax
jne    1140 <do_leak_baseaddress+0x20>
add    $0x1000,%rbx
mov    %rbx,(%rsp)
mov    0x2e81(%rip),%rax
mov    (%rax),%edi
mov    %rsp,%rsi
mov    $0x8,%edx
call   1030 <write@plt>
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@.str = [4 x i8] c"ELF\00"
@STDOUT_FILENO = global i32 0
define void @do_leak_baseaddress() {
%1 = alloca i64
store i64 ptrtoint (void ()* @do_leak_baseaddress to i64), i64* %1
%2 = load i64, i64* %1
%3 = and i64 %2, -4096
store i64 %3, i64* %1
br label %4
4: ; preds = %10, %0
%5 = load i64, i64* %1
%6 = inttoptr i64 %5 to i8*
%7 = getelementptr inbounds i8, i8* %6, i64 1
%8 = call i64 @memcmp(i8* %7, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 3)
%9 = icmp ne i64 %8, 0
br i1 %9, label %10, label %13
10: ; preds = %4
%11 = load i64, i64* %1
%12 = sub i64 %11, 4096
store i64 %12, i64* %1
br label %4
13: ; preds = %4
%14 = load i32, i32* @STDOUT_FILENO
%15 = call i32 @write(i32 %14, i64* %1, i32 8)
ret void
}

LLVM IR (-O2):
@.str = [4 x i8] c"ELF\00"
@STDOUT_FILENO = global i32 0
define void @do_leak_baseaddress() {
%1 = alloca i64
%2 = bitcast i64* %1 to i8*
br label %3
3: ; preds = %3, %0
%4 = phi i64 [ and (i64 ptrtoint (void ()* @do_leak_baseaddress to i64), i64 -4096), %0 ], [ %9, %3 ]
%5 = inttoptr i64 %4 to i8*
%6 = getelementptr inbounds i8, i8* %5, i64 1
%7 = tail call i64 @memcmp(i8* %6, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 3)
%8 = icmp eq i64 %7, 0
%9 = add i64 %4, -4096
br i1 %8, label %10, label %3
10: ; preds = %3
store i64 %4, i64* %1
%11 = load i32, i32* @STDOUT_FILENO
%12 = call i32 @write(i32 %11, i64* %1, i32 8)
ret void
}