#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int uint32_t;
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ fgets(char *, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ pclose(int /*<<< orphan*/ *);
int /*<<< orphan*/ *popen(char *, char *);
int sprintf(char *, char *, char *, char *, char *);
void get_xnu_core_addresses(char *buffer, uint32_t *pos, uint32_t max) {
  FILE *fp = NULL;
  char addr1[17];
  char addr2[17];
  fp = popen("nm /System/Library/Kernels/kernel  | head -n1", "r");
  fgets(addr1, 17, fp);
  pclose(fp);
  fp = popen("nm /System/Library/Kernels/kernel  | tail -n1", "r");
  fgets(addr2, 17, fp);
  pclose(fp);
  (*pos) += sprintf(
      buffer + (*pos), "XNU Core Address Range:%s\n0x%s\t0x%s\n\n",
      "\n------------------------------------------------------------------",
      addr1, addr2);
}


x86 assembly (clang, -O0):
<get_xnu_core_addresses>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %edx,-0x14(%rbp)
movq   $0x0,-0x20(%rbp)
lea    0xe9e(%rip),%rdi
lea    0xec5(%rip),%rsi
call   1050 <popen@plt>
mov    %rax,-0x20(%rbp)
lea    -0x40(%rbp),%rdi
mov    -0x20(%rbp),%rdx
mov    $0x11,%esi
call   1040 <fgets@plt>
mov    -0x20(%rbp),%rdi
call   1030 <pclose@plt>
lea    0xe9c(%rip),%rdi
lea    0xe93(%rip),%rsi
call   1050 <popen@plt>
mov    %rax,-0x20(%rbp)
lea    -0x60(%rbp),%rdi
mov    -0x20(%rbp),%rdx
mov    $0x11,%esi
call   1040 <fgets@plt>
mov    -0x20(%rbp),%rdi
call   1030 <pclose@plt>
mov    -0x8(%rbp),%rdi
mov    -0x10(%rbp),%rax
movslq (%rax),%rax
add    %rax,%rdi
lea    -0x40(%rbp),%rcx
lea    -0x60(%rbp),%r8
lea    0xe82(%rip),%rsi
lea    0xea1(%rip),%rdx
call   1060 <sprintf@plt>
mov    %eax,%ecx
mov    -0x10(%rbp),%rax
add    (%rax),%ecx
mov    %ecx,(%rax)
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<get_xnu_core_addresses>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x40,%rsp
mov    %rsi,%r13
mov    %rdi,%r14
lea    0xea6(%rip),%rdi
lea    0xecd(%rip),%r12
mov    %r12,%rsi
call   1050 <popen@plt>
mov    %rax,%rbx
lea    0x20(%rsp),%r15
mov    %r15,%rdi
mov    $0x11,%esi
mov    %rax,%rdx
call   1040 <fgets@plt>
mov    %rbx,%rdi
call   1030 <pclose@plt>
lea    0xea0(%rip),%rdi
mov    %r12,%rsi
call   1050 <popen@plt>
mov    %rax,%rbx
mov    %rsp,%r12
mov    %r12,%rdi
mov    $0x11,%esi
mov    %rax,%rdx
call   1040 <fgets@plt>
mov    %rbx,%rdi
call   1030 <pclose@plt>
movslq 0x0(%r13),%rdi
add    %r14,%rdi
lea    0xe9a(%rip),%rsi
lea    0xeb9(%rip),%rdx
mov    %r15,%rcx
mov    %r12,%r8
call   1060 <sprintf@plt>
add    %eax,0x0(%r13)
add    $0x40,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [46 x i8] c"nm /System/Library/Kernels/kernel | head -n1\00"
@.str.1 = [2 x i8] c"r\00"
@.str.2 = [46 x i8] c"nm /System/Library/Kernels/kernel | tail -n1\00"
@.str.3 = [38 x i8] c"XNU Core Address Range:%s\0A0x%s\090x%s\0A\0A\00"
@.str.4 = [68 x i8] c"\0A------------------------------------------------------------------\00"
define void @get_xnu_core_addresses(i8* %0, i32* %1, i32 %2) {
%4 = alloca i8*
%5 = alloca i32*
%6 = alloca i32
%7 = alloca i32*
%8 = alloca [17 x i8]
%9 = alloca [17 x i8]
store i8* %0, i8** %4
store i32* %1, i32** %5
store i32 %2, i32* %6
store i32* null, i32** %7
%10 = call i32* @popen(i8* getelementptr inbounds ([46 x i8], [46 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
store i32* %10, i32** %7
%11 = getelementptr inbounds [17 x i8], [17 x i8]* %8, i64 0, i64 0
%12 = load i32*, i32** %7
%13 = call i32 @fgets(i8* %11, i32 17, i32* %12)
%14 = load i32*, i32** %7
%15 = call i32 @pclose(i32* %14)
%16 = call i32* @popen(i8* getelementptr inbounds ([46 x i8], [46 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
store i32* %16, i32** %7
%17 = getelementptr inbounds [17 x i8], [17 x i8]* %9, i64 0, i64 0
%18 = load i32*, i32** %7
%19 = call i32 @fgets(i8* %17, i32 17, i32* %18)
%20 = load i32*, i32** %7
%21 = call i32 @pclose(i32* %20)
%22 = load i8*, i8** %4
%23 = load i32*, i32** %5
%24 = load i32, i32* %23
%25 = sext i32 %24 to i64
%26 = getelementptr inbounds i8, i8* %22, i64 %25
%27 = getelementptr inbounds [17 x i8], [17 x i8]* %8, i64 0, i64 0
%28 = getelementptr inbounds [17 x i8], [17 x i8]* %9, i64 0, i64 0
%29 = call i32 @sprintf(i8* %26, i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.3, i64 0, i64 0), i8* getelementptr inbounds ([68 x i8], [68 x i8]* @.str.4, i64 0, i64 0), i8* %27, i8* %28)
%30 = load i32*, i32** %5
%31 = load i32, i32* %30
%32 = add nsw i32 %31, %29
store i32 %32, i32* %30
ret void
}

LLVM IR (-O2):
@.str = [46 x i8] c"nm /System/Library/Kernels/kernel | head -n1\00"
@.str.1 = [2 x i8] c"r\00"
@.str.2 = [46 x i8] c"nm /System/Library/Kernels/kernel | tail -n1\00"
@.str.3 = [38 x i8] c"XNU Core Address Range:%s\0A0x%s\090x%s\0A\0A\00"
@.str.4 = [68 x i8] c"\0A------------------------------------------------------------------\00"
define void @get_xnu_core_addresses(i8* nocapture writeonly %0, i32* nocapture %1, i32 %2) {
%4 = alloca [17 x i8]
%5 = alloca [17 x i8]
%6 = getelementptr inbounds [17 x i8], [17 x i8]* %4, i64 0, i64 0
%7 = getelementptr inbounds [17 x i8], [17 x i8]* %5, i64 0, i64 0
%8 = tail call i32* @popen(i8* getelementptr inbounds ([46 x i8], [46 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
%9 = call i32 @fgets(i8* %6, i32 17, i32* %8)
%10 = call i32 @pclose(i32* %8)
%11 = call i32* @popen(i8* getelementptr inbounds ([46 x i8], [46 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
%12 = call i32 @fgets(i8* %7, i32 17, i32* %11)
%13 = call i32 @pclose(i32* %11)
%14 = load i32, i32* %1
%15 = sext i32 %14 to i64
%16 = getelementptr inbounds i8, i8* %0, i64 %15
%17 = call i32 @sprintf(i8* dereferenceable(1) %16, i8* dereferenceable(1) getelementptr inbounds ([38 x i8], [38 x i8]* @.str.3, i64 0, i64 0), i8* getelementptr inbounds ([68 x i8], [68 x i8]* @.str.4, i64 0, i64 0), i8* %6, i8* %7)
%18 = load i32, i32* %1
%19 = add nsw i32 %18, %17
store i32 %19, i32* %1
ret void
}