char *bar(void *__kallsyms_lookup_name, void *_printk, int a, char *c) {
  void (*ptr)(const char *fmt, ...);
  ptr = _printk;
  ptr("The attacking code just called printk! : "
      "With parameters passing \n");
  ptr(c);
  ptr("%d\n", a);
  unsigned long (*kallsyms_lookup_name)(const char *name);
  kallsyms_lookup_name = __kallsyms_lookup_name;
  void *addr_ptrk = (void *)kallsyms_lookup_name("printk");
  void (*ptr2)(const char *fmt, ...);
  ptr2 = addr_ptrk;
  ptr("Now test printk:\n");
  ptr2("Try to call printk without passed as a funtion pointer\n");
  ptr2("%d\n", a);
  void *(*kmalloc)(int size, int flags);
  kmalloc = (void *)(0xffffffff811a26e0);
  char *test_buf = kmalloc(1024, 0);
  test_buf[0] = 'a';
  test_buf[1] = 'b';
  test_buf[2] = '\0';
  ptr2(test_buf);
  ptr2("\n");
  return "Hello World!";
}


x86 assembly (clang, -O0):
<bar>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %edx,-0x14(%rbp)
mov    %rcx,-0x20(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x28(%rbp)
lea    0xeda(%rip),%rdi
mov    $0x0,%al
call   *-0x28(%rbp)
mov    -0x28(%rbp),%rcx
mov    -0x20(%rbp),%rdi
mov    $0x0,%al
call   *%rcx
mov    -0x28(%rbp),%rcx
mov    -0x14(%rbp),%esi
lea    0xefe(%rip),%rdi
mov    $0x0,%al
call   *%rcx
mov    -0x8(%rbp),%rax
mov    %rax,-0x30(%rbp)
lea    0xeef(%rip),%rdi
call   *-0x30(%rbp)
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rax
mov    %rax,-0x40(%rbp)
lea    0xee0(%rip),%rdi
mov    $0x0,%al
call   *-0x28(%rbp)
lea    0xee6(%rip),%rdi
mov    $0x0,%al
call   *-0x40(%rbp)
mov    -0x40(%rbp),%rcx
mov    -0x14(%rbp),%esi
lea    0xeb6(%rip),%rdi
mov    $0x0,%al
call   *%rcx
mov    $0xffffffff811a26e0,%rax
mov    %rax,-0x48(%rbp)
mov    $0x400,%edi
xor    %esi,%esi
call   *-0x48(%rbp)
mov    %rax,-0x50(%rbp)
mov    -0x50(%rbp),%rax
movb   $0x61,(%rax)
mov    -0x50(%rbp),%rax
movb   $0x62,0x1(%rax)
mov    -0x50(%rbp),%rax
movb   $0x0,0x2(%rax)
mov    -0x40(%rbp),%rcx
mov    -0x50(%rbp),%rdi
mov    $0x0,%al
call   *%rcx
lea    0xe6d(%rip),%rdi
mov    $0x0,%al
call   *-0x40(%rbp)
lea    0xeb8(%rip),%rax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<bar>:
push   %rbp
push   %r15
push   %r14
push   %r12
push   %rbx
mov    %rcx,%rbx
mov    %edx,%r14d
mov    %rsi,%rbp
mov    %rdi,%r15
lea    0xee5(%rip),%rdi
xor    %eax,%eax
call   *%rsi
mov    %rbx,%rdi
xor    %eax,%eax
call   *%rbp
lea    0xf16(%rip),%r12
mov    %r12,%rdi
mov    %r14d,%esi
xor    %eax,%eax
call   *%rbp
lea    0xf09(%rip),%rdi
call   *%r15
mov    %rax,%rbx
lea    0xf03(%rip),%rdi
xor    %eax,%eax
call   *%rbp
lea    0xf0a(%rip),%rdi
xor    %eax,%eax
call   *%rbx
mov    %r12,%rdi
mov    %r14d,%esi
xor    %eax,%eax
call   *%rbx
mov    $0xffffffff811a26e0,%rax
mov    $0x400,%edi
xor    %esi,%esi
call   *%rax
movw   $0x6261,(%rax)
movb   $0x0,0x2(%rax)
mov    %rax,%rdi
xor    %eax,%eax
call   *%rbx
lea    0xeb6(%rip),%rdi
xor    %eax,%eax
call   *%rbx
lea    0xf02(%rip),%rax
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [67 x i8] c"The attacking code just called printk! : With parameters passing \0A\00"
@.str.1 = [4 x i8] c"%d\0A\00"
@.str.2 = [7 x i8] c"printk\00"
@.str.3 = [18 x i8] c"Now test printk:\0A\00"
@.str.4 = [56 x i8] c"Try to call printk without passed as a funtion pointer\0A\00"
@.str.5 = [2 x i8] c"\0A\00"
@.str.6 = [13 x i8] c"Hello World!\00"
define i8* @bar(i8* %0, i8* %1, i32 %2, i8* %3) {
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i8*
%9 = alloca void (i8*, ...)*
%10 = alloca i64 (i8*)*
%11 = alloca i8*
%12 = alloca void (i8*, ...)*
%13 = alloca i8* (i32, i32)*
%14 = alloca i8*
store i8* %0, i8** %5
store i8* %1, i8** %6
store i32 %2, i32* %7
store i8* %3, i8** %8
%15 = load i8*, i8** %6
%16 = bitcast i8* %15 to void (i8*, ...)*
store void (i8*, ...)* %16, void (i8*, ...)** %9
%17 = load void (i8*, ...)*, void (i8*, ...)** %9
%18 = load void (i8*, ...)*, void (i8*, ...)** %9
%19 = load i8*, i8** %8
%20 = load void (i8*, ...)*, void (i8*, ...)** %9
%21 = load i32, i32* %7
%22 = load i8*, i8** %5
%23 = bitcast i8* %22 to i64 (i8*)*
store i64 (i8*)* %23, i64 (i8*)** %10
%24 = load i64 (i8*)*, i64 (i8*)** %10
%25 = call i64 %24(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0))
%26 = inttoptr i64 %25 to i8*
store i8* %26, i8** %11
%27 = load i8*, i8** %11
%28 = bitcast i8* %27 to void (i8*, ...)*
store void (i8*, ...)* %28, void (i8*, ...)** %12
%29 = load void (i8*, ...)*, void (i8*, ...)** %9
%30 = load void (i8*, ...)*, void (i8*, ...)** %12
%31 = load void (i8*, ...)*, void (i8*, ...)** %12
%32 = load i32, i32* %7
store i8* (i32, i32)* inttoptr (i64 -2128992544 to i8* (i32, i32)*), i8* (i32, i32)** %13
%33 = load i8* (i32, i32)*, i8* (i32, i32)** %13
%34 = call i8* %33(i32 1024, i32 0)
store i8* %34, i8** %14
%35 = load i8*, i8** %14
%36 = getelementptr inbounds i8, i8* %35, i64 0
store i8 97, i8* %36
%37 = load i8*, i8** %14
%38 = getelementptr inbounds i8, i8* %37, i64 1
store i8 98, i8* %38
%39 = load i8*, i8** %14
%40 = getelementptr inbounds i8, i8* %39, i64 2
store i8 0, i8* %40
%41 = load void (i8*, ...)*, void (i8*, ...)** %12
%42 = load i8*, i8** %14
%43 = load void (i8*, ...)*, void (i8*, ...)** %12
ret i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.6, i64 0, i64 0)
}

LLVM IR (-O2):
@.str = [67 x i8] c"The attacking code just called printk! : With parameters passing \0A\00"
@.str.1 = [4 x i8] c"%d\0A\00"
@.str.2 = [7 x i8] c"printk\00"
@.str.3 = [18 x i8] c"Now test printk:\0A\00"
@.str.4 = [56 x i8] c"Try to call printk without passed as a funtion pointer\0A\00"
@.str.5 = [2 x i8] c"\0A\00"
@.str.6 = [13 x i8] c"Hello World!\00"
define i8* @bar(i8* nocapture %0, i8* nocapture %1, i32 %2, i8* %3) {
%5 = bitcast i8* %1 to void (i8*, ...)*
tail call void (i8*, ...) %5(i8* getelementptr inbounds ([67 x i8], [67 x i8]* @.str, i64 0, i64 0))
tail call void (i8*, ...) %5(i8* %3)
tail call void (i8*, ...) %5(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i64 0, i64 0), i32 %2)
%6 = bitcast i8* %0 to i64 (i8*)*
%7 = tail call i64 %6(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.2, i64 0, i64 0))
%8 = inttoptr i64 %7 to void (i8*, ...)*
tail call void (i8*, ...) %5(i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.3, i64 0, i64 0))
tail call void (i8*, ...) %8(i8* getelementptr inbounds ([56 x i8], [56 x i8]* @.str.4, i64 0, i64 0))
tail call void (i8*, ...) %8(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i64 0, i64 0), i32 %2)
%9 = tail call i8* inttoptr (i64 -2128992544 to i8* (i32, i32)*)(i32 1024, i32 0)
store i8 97, i8* %9
%10 = getelementptr inbounds i8, i8* %9, i64 1
store i8 98, i8* %10
%11 = getelementptr inbounds i8, i8* %9, i64 2
store i8 0, i8* %11
tail call void (i8*, ...) %8(i8* %9)
tail call void (i8*, ...) %8(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0))
ret i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.6, i64 0, i64 0)
}