#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ uint8_t;

/* Variables and functions */
int detect_mode(int /*<<< orphan*/ *, int);
int /*<<< orphan*/ *encryption_oracle(int /*<<< orphan*/ *, int, int *, int *);
int /*<<< orphan*/ free(int /*<<< orphan*/ *);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ srand(int /*<<< orphan*/);
int strlen(char *);
int /*<<< orphan*/ time(int /*<<< orphan*/ *);
void challenge11(char *str) {
  uint8_t *enc;
  int out_len;
  int real;
  int detected;
  int num_ecb;
  int num_cbc;
  int successes;
  int len;
  int i;
  float percentage;
  printf("*** Challenge 11: An ECB/CBC detection oracle\n");
  srand(time(NULL));
  len = strlen(str);
  successes = 0;
  num_ecb = 0;
  num_cbc = 0;
  for (i = 0; i < 100; i++) {
    enc = encryption_oracle((uint8_t *)str, len, &real, &out_len);
    detected = detect_mode(enc, out_len);
    if (real == 0)
      num_ecb++;
    else
      num_cbc++;
    if (real == detected)
      successes++;
    free(enc);
  }
  percentage = 100 * (float)num_ecb / 100;
  printf("ECB encryption rate: %.0f%%\n", percentage);
  percentage = 100 * (float)num_cbc / 100;
  printf("CBC encryption rate: %.0f%%\n", percentage);
  percentage = 100 * (float)successes / 100;
  printf("Detection success rate: %.0f%%\n", percentage);
}


x86 assembly (clang, -O0):
<challenge11>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x8(%rbp)
lea    0xe81(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
xor    %eax,%eax
mov    %eax,%edi
call   1080 <time@plt>
mov    %eax,%edi
call   1060 <srand@plt>
mov    -0x8(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,-0x2c(%rbp)
movl   $0x0,-0x28(%rbp)
movl   $0x0,-0x20(%rbp)
movl   $0x0,-0x24(%rbp)
movl   $0x0,-0x30(%rbp)
cmpl   $0x64,-0x30(%rbp)
jge    1240 <challenge11+0xd0>
mov    -0x8(%rbp),%rdi
mov    -0x2c(%rbp),%esi
lea    -0x18(%rbp),%rdx
lea    -0x14(%rbp),%rcx
call   1070 <encryption_oracle@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rdi
mov    -0x14(%rbp),%esi
call   1090 <detect_mode@plt>
mov    %eax,-0x1c(%rbp)
cmpl   $0x0,-0x18(%rbp)
jne    120b <challenge11+0x9b>
mov    -0x20(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x20(%rbp)
jmp    1214 <challenge11+0xa4>
mov    -0x24(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x24(%rbp)
mov    -0x18(%rbp),%eax
cmp    -0x1c(%rbp),%eax
jne    1229 <challenge11+0xb9>
mov    -0x28(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x28(%rbp)
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
mov    -0x30(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x30(%rbp)
jmp    11c2 <challenge11+0x52>
cvtsi2ssl -0x20(%rbp),%xmm1
movss  0xdb3(%rip),%xmm0
mulss  %xmm1,%xmm0
movss  0xda7(%rip),%xmm1
divss  %xmm1,%xmm0
movss  %xmm0,-0x34(%rbp)
movss  -0x34(%rbp),%xmm0
cvtss2sd %xmm0,%xmm0
lea    0xdc1(%rip),%rdi
mov    $0x1,%al
call   1050 <printf@plt>
cvtsi2ssl -0x24(%rbp),%xmm1
movss  0xd7a(%rip),%xmm0
mulss  %xmm1,%xmm0
movss  0xd6e(%rip),%xmm1
divss  %xmm1,%xmm0
movss  %xmm0,-0x34(%rbp)
movss  -0x34(%rbp),%xmm0
cvtss2sd %xmm0,%xmm0
lea    0xda5(%rip),%rdi
mov    $0x1,%al
call   1050 <printf@plt>
cvtsi2ssl -0x28(%rbp),%xmm1
movss  0xd41(%rip),%xmm0
mulss  %xmm1,%xmm0
movss  0xd35(%rip),%xmm1
divss  %xmm1,%xmm0
movss  %xmm0,-0x34(%rbp)
movss  -0x34(%rbp),%xmm0
cvtss2sd %xmm0,%xmm0
lea    0xd89(%rip),%rdi
mov    $0x1,%al
call   1050 <printf@plt>
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<challenge11>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %rdi,%rbx
lea    0xec6(%rip),%rdi
call   1040 <puts@plt>
xor    %r14d,%r14d
xor    %edi,%edi
call   1090 <time@plt>
mov    %eax,%edi
call   1070 <srand@plt>
mov    %rbx,0x10(%rsp)
mov    %rbx,%rdi
call   1050 <strlen@plt>
mov    %eax,%r13d
mov    $0x64,%r12d
xor    %r15d,%r15d
xor    %ebp,%ebp
nopl   0x0(%rax)
mov    0x10(%rsp),%rdi
mov    %r13d,%esi
lea    0x8(%rsp),%rdx
lea    0xc(%rsp),%rcx
call   1080 <encryption_oracle@plt>
mov    %rax,%rbx
mov    0xc(%rsp),%esi
mov    %rax,%rdi
call   10a0 <detect_mode@plt>
mov    0x8(%rsp),%ecx
xor    %edx,%edx
xor    %esi,%esi
test   %ecx,%ecx
sete   %dl
setne  %sil
add    %esi,%r15d
add    %edx,%r14d
xor    %edx,%edx
cmp    %eax,%ecx
sete   %dl
add    %edx,%ebp
mov    %rbx,%rdi
call   1030 <free@plt>
add    $0xffffffff,%r12d
jne    11d0 <challenge11+0x50>
cvtsi2ss %r14d,%xmm0
movss  0xdcf(%rip),%xmm1
mulss  %xmm1,%xmm0
divss  %xmm1,%xmm0
cvtss2sd %xmm0,%xmm0
lea    0xdc0(%rip),%rdi
mov    $0x1,%al
call   1060 <printf@plt>
xorps  %xmm0,%xmm0
cvtsi2ss %r15d,%xmm0
movss  0xda5(%rip),%xmm1
mulss  %xmm1,%xmm0
divss  %xmm1,%xmm0
cvtss2sd %xmm0,%xmm0
lea    0xdb3(%rip),%rdi
mov    $0x1,%al
call   1060 <printf@plt>
xorps  %xmm0,%xmm0
cvtsi2ss %ebp,%xmm0
movss  0xd7c(%rip),%xmm1
mulss  %xmm1,%xmm0
divss  %xmm1,%xmm0
cvtss2sd %xmm0,%xmm0
lea    0xda7(%rip),%rdi
mov    $0x1,%al
call   1060 <printf@plt>
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [47 x i8] c"*** Challenge 11: An ECB/CBC detection oracle\0A\00"
@.str.1 = [29 x i8] c"ECB encryption rate: %.0f%%\0A\00"
@.str.2 = [29 x i8] c"CBC encryption rate: %.0f%%\0A\00"
@.str.3 = [32 x i8] c"Detection success rate: %.0f%%\0A\00"
define void @challenge11(i8* %0) {
%2 = alloca i8*
%3 = alloca i32*
%4 = alloca i32
%5 = alloca i32
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i32
%12 = alloca float
store i8* %0, i8** %2
%13 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([47 x i8], [47 x i8]* @.str, i64 0, i64 0))
%14 = call i32 @time(i32* null)
%15 = call i32 @srand(i32 %14)
%16 = load i8*, i8** %2
%17 = call i32 @strlen(i8* %16)
store i32 %17, i32* %10
store i32 0, i32* %9
store i32 0, i32* %7
store i32 0, i32* %8
store i32 0, i32* %11
br label %18
18: ; preds = %47, %1
%19 = load i32, i32* %11
%20 = icmp slt i32 %19, 100
br i1 %20, label %21, label %50
21: ; preds = %18
%22 = load i8*, i8** %2
%23 = bitcast i8* %22 to i32*
%24 = load i32, i32* %10
%25 = call i32* @encryption_oracle(i32* %23, i32 %24, i32* %5, i32* %4)
store i32* %25, i32** %3
%26 = load i32*, i32** %3
%27 = load i32, i32* %4
%28 = call i32 @detect_mode(i32* %26, i32 %27)
store i32 %28, i32* %6
%29 = load i32, i32* %5
%30 = icmp eq i32 %29, 0
br i1 %30, label %31, label %34
31: ; preds = %21
%32 = load i32, i32* %7
%33 = add nsw i32 %32, 1
store i32 %33, i32* %7
br label %37
34: ; preds = %21
%35 = load i32, i32* %8
%36 = add nsw i32 %35, 1
store i32 %36, i32* %8
br label %37
37: ; preds = %34, %31
%38 = load i32, i32* %5
%39 = load i32, i32* %6
%40 = icmp eq i32 %38, %39
br i1 %40, label %41, label %44
41: ; preds = %37
%42 = load i32, i32* %9
%43 = add nsw i32 %42, 1
store i32 %43, i32* %9
br label %44
44: ; preds = %41, %37
%45 = load i32*, i32** %3
%46 = call i32 @free(i32* %45)
br label %47
47: ; preds = %44
%48 = load i32, i32* %11
%49 = add nsw i32 %48, 1
store i32 %49, i32* %11
br label %18
50: ; preds = %18
%51 = load i32, i32* %7
%52 = sitofp i32 %51 to float
%53 = fmul float 1.000000e+02, %52
%54 = fdiv float %53, 1.000000e+02
store float %54, float* %12
%55 = load float, float* %12
%56 = fpext float %55 to double
%57 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.1, i64 0, i64 0), double %56)
%58 = load i32, i32* %8
%59 = sitofp i32 %58 to float
%60 = fmul float 1.000000e+02, %59
%61 = fdiv float %60, 1.000000e+02
store float %61, float* %12
%62 = load float, float* %12
%63 = fpext float %62 to double
%64 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.2, i64 0, i64 0), double %63)
%65 = load i32, i32* %9
%66 = sitofp i32 %65 to float
%67 = fmul float 1.000000e+02, %66
%68 = fdiv float %67, 1.000000e+02
store float %68, float* %12
%69 = load float, float* %12
%70 = fpext float %69 to double
%71 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([32 x i8], [32 x i8]* @.str.3, i64 0, i64 0), double %70)
ret void
}

LLVM IR (-O2):
@.str.1 = [29 x i8] c"ECB encryption rate: %.0f%%\0A\00"
@.str.2 = [29 x i8] c"CBC encryption rate: %.0f%%\0A\00"
@.str.3 = [32 x i8] c"Detection success rate: %.0f%%\0A\00"
@str = [46 x i8] c"*** Challenge 11: An ECB/CBC detection oracle\00"
define void @challenge11(i8* %0) {
%2 = alloca i32
%3 = alloca i32
%4 = bitcast i32* %2 to i8*
%5 = bitcast i32* %3 to i8*
%6 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([46 x i8], [46 x i8]* @str, i64 0, i64 0))
%7 = tail call i32 @time(i32* null)
%8 = tail call i32 @srand(i32 %7)
%9 = tail call i32 @strlen(i8* %0)
%10 = bitcast i8* %0 to i32*
br label %11
11: ; preds = %1, %11
%12 = phi i32 [ 0, %1 ], [ %25, %11 ]
%13 = phi i32 [ 0, %1 ], [ %30, %11 ]
%14 = phi i32 [ 0, %1 ], [ %23, %11 ]
%15 = phi i32 [ 0, %1 ], [ %28, %11 ]
%16 = call i32* @encryption_oracle(i32* %10, i32 %9, i32* %3, i32* %2)
%17 = load i32, i32* %2
%18 = call i32 @detect_mode(i32* %16, i32 %17)
%19 = load i32, i32* %3
%20 = icmp eq i32 %19, 0
%21 = xor i1 %20, true
%22 = zext i1 %21 to i32
%23 = add nuw nsw i32 %14, %22
%24 = zext i1 %20 to i32
%25 = add nuw nsw i32 %12, %24
%26 = icmp eq i32 %19, %18
%27 = zext i1 %26 to i32
%28 = add nuw nsw i32 %15, %27
%29 = call i32 @free(i32* %16)
%30 = add nuw nsw i32 %13, 1
%31 = icmp eq i32 %30, 100
br i1 %31, label %32, label %11
32: ; preds = %11
%33 = sitofp i32 %25 to float
%34 = fmul float %33, 1.000000e+02
%35 = fdiv float %34, 1.000000e+02
%36 = fpext float %35 to double
%37 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @.str.1, i64 0, i64 0), double %36)
%38 = sitofp i32 %23 to float
%39 = fmul float %38, 1.000000e+02
%40 = fdiv float %39, 1.000000e+02
%41 = fpext float %40 to double
%42 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @.str.2, i64 0, i64 0), double %41)
%43 = sitofp i32 %28 to float
%44 = fmul float %43, 1.000000e+02
%45 = fdiv float %44, 1.000000e+02
%46 = fpext float %45 to double
%47 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([32 x i8], [32 x i8]* @.str.3, i64 0, i64 0), double %46)
ret void
}