#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int MAP_ANONYMOUS;
char *MAP_FAILED;
int MAP_PRIVATE;
int PROT_READ;
int PROT_WRITE;
char *mmap(void *, int, int, int, int, int /*<<< orphan*/);
int /*<<< orphan*/ munmap(char *, int);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ puts(char *);
int /*<<< orphan*/ strcpy(char *, char *);
int main() {
  char *p = mmap(NULL, 0x100, PROT_READ | PROT_WRITE,
                 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  printf("%p\n", p);
  if (p == MAP_FAILED) {
    printf("%m");
    return -1;
  }
  strcpy(p, "欢迎使用mmap");
  puts(p);
  char *q = mmap((void *)0x9f5a000, 0x88, PROT_READ,
                 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  printf("%p\n", q);
  munmap(p, 0x100);
  munmap(q, 0x88);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    0x2e92(%rip),%rax
mov    (%rax),%edx
mov    0x2e61(%rip),%rax
or     (%rax),%edx
mov    0x2e50(%rip),%rax
mov    (%rax),%ecx
mov    0x2e5f(%rip),%rax
or     (%rax),%ecx
xor    %eax,%eax
mov    %eax,%edi
mov    $0x100,%esi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1050 <mmap@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rsi
lea    0xe57(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    -0x10(%rbp),%rax
mov    0x2e05(%rip),%rcx
cmp    (%rcx),%rax
jne    11de <main+0x8e>
lea    0xe39(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    125c <main+0x10c>
mov    -0x10(%rbp),%rdi
lea    0xe1e(%rip),%rsi
call   1030 <strcpy@plt>
mov    -0x10(%rbp),%rdi
call   1040 <puts@plt>
mov    0x2dfa(%rip),%rax
mov    (%rax),%edx
mov    0x2dc1(%rip),%rax
mov    (%rax),%ecx
mov    0x2dd0(%rip),%rax
or     (%rax),%ecx
mov    $0x9f5a000,%edi
mov    $0x88,%esi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1050 <mmap@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rsi
lea    0xdc7(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    -0x10(%rbp),%rdi
mov    $0x100,%esi
call   1070 <munmap@plt>
mov    -0x18(%rbp),%rdi
mov    $0x88,%esi
call   1070 <munmap@plt>
mov    -0x4(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r12
push   %rbx
mov    0x2e99(%rip),%r14
mov    0x2e6a(%rip),%rax
mov    (%rax),%edx
or     (%r14),%edx
mov    0x2e56(%rip),%r15
mov    0x2e67(%rip),%r12
mov    (%r12),%ecx
or     (%r15),%ecx
mov    $0xffffffff,%ebp
xor    %edi,%edi
mov    $0x100,%esi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1050 <mmap@plt>
mov    %rax,%rbx
lea    0xe5c(%rip),%rdi
mov    %rax,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
mov    0x2e0b(%rip),%rax
cmp    (%rax),%rbx
je     1225 <main+0xd5>
lea    0xe46(%rip),%rsi
mov    %rbx,%rdi
call   1030 <strcpy@plt>
mov    %rbx,%rdi
call   1040 <puts@plt>
mov    (%r14),%edx
mov    (%r12),%ecx
or     (%r15),%ecx
mov    $0x9f5a000,%edi
mov    $0x88,%esi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1050 <mmap@plt>
mov    %rax,%rbp
lea    0xe03(%rip),%rdi
mov    %rax,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
mov    %rbx,%rdi
mov    $0x100,%esi
call   1070 <munmap@plt>
mov    %rbp,%rdi
mov    $0x88,%esi
call   1070 <munmap@plt>
xor    %ebp,%ebp
jmp    1233 <main+0xe3>
lea    0xdd8(%rip),%rdi
xor    %eax,%eax
call   1060 <printf@plt>
mov    %ebp,%eax
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@.str = [4 x i8] c"%p\0A\00"
@MAP_FAILED = global i8* null
@.str.1 = [3 x i8] c"%m\00"
@.str.2 = [17 x i8] c"\E6\AC\A2\E8\BF\8E\E4\BD\BF\E7\94\A8mmap\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i8*
%3 = alloca i8*
store i32 0, i32* %1
%4 = load i32, i32* @PROT_READ
%5 = load i32, i32* @PROT_WRITE
%6 = or i32 %4, %5
%7 = load i32, i32* @MAP_PRIVATE
%8 = load i32, i32* @MAP_ANONYMOUS
%9 = or i32 %7, %8
%10 = call i8* @mmap(i8* null, i32 256, i32 %6, i32 %9, i32 -1, i32 0)
store i8* %10, i8** %2
%11 = load i8*, i8** %2
%12 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i8* %11)
%13 = load i8*, i8** %2
%14 = load i8*, i8** @MAP_FAILED
%15 = icmp eq i8* %13, %14
br i1 %15, label %16, label %18
16: ; preds = %0
%17 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
store i32 -1, i32* %1
br label %34
18: ; preds = %0
%19 = load i8*, i8** %2
%20 = call i32 @strcpy(i8* %19, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.2, i64 0, i64 0))
%21 = load i8*, i8** %2
%22 = call i32 @puts(i8* %21)
%23 = load i32, i32* @PROT_READ
%24 = load i32, i32* @MAP_PRIVATE
%25 = load i32, i32* @MAP_ANONYMOUS
%26 = or i32 %24, %25
%27 = call i8* @mmap(i8* inttoptr (i64 167092224 to i8*), i32 136, i32 %23, i32 %26, i32 -1, i32 0)
store i8* %27, i8** %3
%28 = load i8*, i8** %3
%29 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i8* %28)
%30 = load i8*, i8** %2
%31 = call i32 @munmap(i8* %30, i32 256)
%32 = load i8*, i8** %3
%33 = call i32 @munmap(i8* %32, i32 136)
br label %34
34: ; preds = %18, %16
%35 = load i32, i32* %1
ret i32 %35
}

LLVM IR (-O2):
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@.str = [4 x i8] c"%p\0A\00"
@MAP_FAILED = global i8* null
@.str.1 = [3 x i8] c"%m\00"
@.str.2 = [17 x i8] c"\E6\AC\A2\E8\BF\8E\E4\BD\BF\E7\94\A8mmap\00"
define i32 @main() {
%1 = load i32, i32* @PROT_READ
%2 = load i32, i32* @PROT_WRITE
%3 = or i32 %2, %1
%4 = load i32, i32* @MAP_PRIVATE
%5 = load i32, i32* @MAP_ANONYMOUS
%6 = or i32 %5, %4
%7 = tail call i8* @mmap(i8* null, i32 256, i32 %3, i32 %6, i32 -1, i32 0)
%8 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i8* %7)
%9 = load i8*, i8** @MAP_FAILED
%10 = icmp eq i8* %7, %9
br i1 %10, label %11, label %13
11: ; preds = %0
%12 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0))
br label %24
13: ; preds = %0
%14 = tail call i32 @strcpy(i8* %7, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.2, i64 0, i64 0))
%15 = tail call i32 @puts(i8* dereferenceable(1) %7)
%16 = load i32, i32* @PROT_READ
%17 = load i32, i32* @MAP_PRIVATE
%18 = load i32, i32* @MAP_ANONYMOUS
%19 = or i32 %18, %17
%20 = tail call i8* @mmap(i8* inttoptr (i64 167092224 to i8*), i32 136, i32 %16, i32 %19, i32 -1, i32 0)
%21 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i8* %20)
%22 = tail call i32 @munmap(i8* %7, i32 256)
%23 = tail call i32 @munmap(i8* %20, i32 136)
br label %24
24: ; preds = %13, %11
%25 = phi i32 [ -1, %11 ], [ 0, %13 ]
ret i32 %25
}