#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int uint32_t;

/* Variables and functions */
int get_uint32le(unsigned char *);
unsigned char *malloc(int);
int /*<<< orphan*/ memcpy(unsigned char *, unsigned char *, int);
int /*<<< orphan*/ printf(char *, int);
int /*<<< orphan*/ put_uint32le(int, unsigned char *);
int /*<<< orphan*/ telechips_encode_crc(unsigned char *, int);
unsigned char *patch_firmware_tcc(unsigned char *of_buf, int of_size,
                                  unsigned char *boot_buf, int boot_size,
                                  int *patched_size) {
  unsigned char *patched_buf;
  uint32_t ldr, old_ep_offset, new_ep_offset;
  int of_offset;
  patched_buf = malloc(of_size + boot_size);
  if (!patched_buf)
    return NULL;
  memcpy(patched_buf, of_buf, of_size);
  memcpy(patched_buf + of_size, boot_buf, boot_size);
  ldr = get_uint32le(patched_buf);
  of_offset = (ldr & 0xfff) + 8;
  old_ep_offset = get_uint32le(patched_buf + of_offset);
  new_ep_offset = 0x20000000 + of_size;
  printf("OF entry point: 0x%08x\n", old_ep_offset);
  printf("New entry point: 0x%08x\n", new_ep_offset + 8);
  put_uint32le(old_ep_offset, patched_buf + of_size);
  put_uint32le(new_ep_offset, patched_buf + of_size + 4);
  put_uint32le(new_ep_offset + 8, patched_buf + of_offset);
  telechips_encode_crc(patched_buf, of_size + boot_size);
  *patched_size = of_size + boot_size;
  return patched_buf;
}


x86 assembly (clang, -O0):
<patch_firmware_tcc>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
mov    %rdi,-0x10(%rbp)
mov    %esi,-0x14(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %ecx,-0x24(%rbp)
mov    %r8,-0x30(%rbp)
mov    -0x14(%rbp),%edi
add    -0x24(%rbp),%edi
call   1070 <malloc@plt>
mov    %rax,-0x38(%rbp)
cmpq   $0x0,-0x38(%rbp)
jne    11a1 <patch_firmware_tcc+0x41>
movq   $0x0,-0x8(%rbp)
jmp    1284 <patch_firmware_tcc+0x124>
mov    -0x38(%rbp),%rdi
mov    -0x10(%rbp),%rsi
mov    -0x14(%rbp),%edx
call   1050 <memcpy@plt>
mov    -0x38(%rbp),%rdi
movslq -0x14(%rbp),%rax
add    %rax,%rdi
mov    -0x20(%rbp),%rsi
mov    -0x24(%rbp),%edx
call   1050 <memcpy@plt>
mov    -0x38(%rbp),%rdi
call   1080 <get_uint32le@plt>
mov    %eax,-0x3c(%rbp)
mov    -0x3c(%rbp),%eax
and    $0xfff,%eax
add    $0x8,%eax
mov    %eax,-0x48(%rbp)
mov    -0x38(%rbp),%rdi
movslq -0x48(%rbp),%rax
add    %rax,%rdi
call   1080 <get_uint32le@plt>
mov    %eax,-0x40(%rbp)
mov    -0x14(%rbp),%eax
add    $0x20000000,%eax
mov    %eax,-0x44(%rbp)
mov    -0x40(%rbp),%esi
lea    0xdf6(%rip),%rdi
call   1040 <printf@plt>
mov    -0x44(%rbp),%esi
add    $0x8,%esi
lea    0xdfc(%rip),%rdi
call   1040 <printf@plt>
mov    -0x40(%rbp),%edi
mov    -0x38(%rbp),%rsi
movslq -0x14(%rbp),%rax
add    %rax,%rsi
call   1030 <put_uint32le@plt>
mov    -0x44(%rbp),%edi
mov    -0x38(%rbp),%rsi
movslq -0x14(%rbp),%rax
add    %rax,%rsi
add    $0x4,%rsi
call   1030 <put_uint32le@plt>
mov    -0x44(%rbp),%edi
add    $0x8,%edi
mov    -0x38(%rbp),%rsi
movslq -0x48(%rbp),%rax
add    %rax,%rsi
call   1030 <put_uint32le@plt>
mov    -0x38(%rbp),%rdi
mov    -0x14(%rbp),%esi
add    -0x24(%rbp),%esi
call   1060 <telechips_encode_crc@plt>
mov    -0x14(%rbp),%ecx
add    -0x24(%rbp),%ecx
mov    -0x30(%rbp),%rax
mov    %ecx,(%rax)
mov    -0x38(%rbp),%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<patch_firmware_tcc>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %r8,0x10(%rsp)
mov    %ecx,%r14d
mov    %rdx,%r13
mov    %esi,%ebp
mov    %rdi,%r15
lea    (%r14,%rbp,1),%r12d
mov    %r12d,%edi
call   1070 <malloc@plt>
mov    %rax,%rbx
test   %rax,%rax
je     1243 <patch_firmware_tcc+0xe3>
mov    %rbx,%rdi
mov    %r15,%rsi
mov    %ebp,%edx
call   1050 <memcpy@plt>
movslq %ebp,%r15
lea    (%rbx,%r15,1),%rdi
mov    %rdi,0x8(%rsp)
mov    %r13,%rsi
mov    %r14d,%edx
call   1050 <memcpy@plt>
mov    %rbx,%rdi
call   1080 <get_uint32le@plt>
and    $0xfff,%eax
lea    (%rax,%rbx,1),%r14
add    $0x8,%r14
mov    %r14,%rdi
call   1080 <get_uint32le@plt>
mov    %eax,%ebp
lea    0x20000000(%r15),%eax
mov    %eax,0x4(%rsp)
lea    0xe15(%rip),%rdi
mov    %ebp,%esi
call   1040 <printf@plt>
lea    0x20000008(%r15),%r13d
lea    0xe18(%rip),%rdi
mov    %r13d,%esi
call   1040 <printf@plt>
mov    %ebp,%edi
mov    0x8(%rsp),%rsi
call   1030 <put_uint32le@plt>
lea    (%rbx,%r15,1),%rsi
add    $0x4,%rsi
mov    0x4(%rsp),%edi
call   1030 <put_uint32le@plt>
mov    %r13d,%edi
mov    %r14,%rsi
call   1030 <put_uint32le@plt>
mov    %rbx,%rdi
mov    %r12d,%esi
call   1060 <telechips_encode_crc@plt>
mov    0x10(%rsp),%rax
mov    %r12d,(%rax)
mov    %rbx,%rax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [24 x i8] c"OF entry point: 0x%08x\0A\00"
@.str.1 = [25 x i8] c"New entry point: 0x%08x\0A\00"
define i8* @patch_firmware_tcc(i8* %0, i32 %1, i8* %2, i32 %3, i32* %4) {
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i32
%9 = alloca i8*
%10 = alloca i32
%11 = alloca i32*
%12 = alloca i8*
%13 = alloca i32
%14 = alloca i32
%15 = alloca i32
%16 = alloca i32
store i8* %0, i8** %7
store i32 %1, i32* %8
store i8* %2, i8** %9
store i32 %3, i32* %10
store i32* %4, i32** %11
%17 = load i32, i32* %8
%18 = load i32, i32* %10
%19 = add nsw i32 %17, %18
%20 = call i8* @malloc(i32 %19)
store i8* %20, i8** %12
%21 = load i8*, i8** %12
%22 = icmp ne i8* %21, null
br i1 %22, label %24, label %23
23: ; preds = %5
store i8* null, i8** %6
br label %83
24: ; preds = %5
%25 = load i8*, i8** %12
%26 = load i8*, i8** %7
%27 = load i32, i32* %8
%28 = call i32 @memcpy(i8* %25, i8* %26, i32 %27)
%29 = load i8*, i8** %12
%30 = load i32, i32* %8
%31 = sext i32 %30 to i64
%32 = getelementptr inbounds i8, i8* %29, i64 %31
%33 = load i8*, i8** %9
%34 = load i32, i32* %10
%35 = call i32 @memcpy(i8* %32, i8* %33, i32 %34)
%36 = load i8*, i8** %12
%37 = call i32 @get_uint32le(i8* %36)
store i32 %37, i32* %13
%38 = load i32, i32* %13
%39 = and i32 %38, 4095
%40 = add nsw i32 %39, 8
store i32 %40, i32* %16
%41 = load i8*, i8** %12
%42 = load i32, i32* %16
%43 = sext i32 %42 to i64
%44 = getelementptr inbounds i8, i8* %41, i64 %43
%45 = call i32 @get_uint32le(i8* %44)
store i32 %45, i32* %14
%46 = load i32, i32* %8
%47 = add nsw i32 536870912, %46
store i32 %47, i32* %15
%48 = load i32, i32* %14
%49 = call i32 @printf(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str, i64 0, i64 0), i32 %48)
%50 = load i32, i32* %15
%51 = add nsw i32 %50, 8
%52 = call i32 @printf(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.1, i64 0, i64 0), i32 %51)
%53 = load i32, i32* %14
%54 = load i8*, i8** %12
%55 = load i32, i32* %8
%56 = sext i32 %55 to i64
%57 = getelementptr inbounds i8, i8* %54, i64 %56
%58 = call i32 @put_uint32le(i32 %53, i8* %57)
%59 = load i32, i32* %15
%60 = load i8*, i8** %12
%61 = load i32, i32* %8
%62 = sext i32 %61 to i64
%63 = getelementptr inbounds i8, i8* %60, i64 %62
%64 = getelementptr inbounds i8, i8* %63, i64 4
%65 = call i32 @put_uint32le(i32 %59, i8* %64)
%66 = load i32, i32* %15
%67 = add nsw i32 %66, 8
%68 = load i8*, i8** %12
%69 = load i32, i32* %16
%70 = sext i32 %69 to i64
%71 = getelementptr inbounds i8, i8* %68, i64 %70
%72 = call i32 @put_uint32le(i32 %67, i8* %71)
%73 = load i8*, i8** %12
%74 = load i32, i32* %8
%75 = load i32, i32* %10
%76 = add nsw i32 %74, %75
%77 = call i32 @telechips_encode_crc(i8* %73, i32 %76)
%78 = load i32, i32* %8
%79 = load i32, i32* %10
%80 = add nsw i32 %78, %79
%81 = load i32*, i32** %11
store i32 %80, i32* %81
%82 = load i8*, i8** %12
store i8* %82, i8** %6
br label %83
83: ; preds = %24, %23
%84 = load i8*, i8** %6
ret i8* %84
}

LLVM IR (-O2):
@.str = [24 x i8] c"OF entry point: 0x%08x\0A\00"
@.str.1 = [25 x i8] c"New entry point: 0x%08x\0A\00"
define i8* @patch_firmware_tcc(i8* %0, i32 %1, i8* %2, i32 %3, i32* nocapture writeonly %4) {
%6 = add nsw i32 %3, %1
%7 = tail call i8* @malloc(i32 %6)
%8 = icmp eq i8* %7, null
br i1 %8, label %29, label %9
9: ; preds = %5
%10 = tail call i32 @memcpy(i8* %7, i8* %0, i32 %1)
%11 = sext i32 %1 to i64
%12 = getelementptr inbounds i8, i8* %7, i64 %11
%13 = tail call i32 @memcpy(i8* %12, i8* %2, i32 %3)
%14 = tail call i32 @get_uint32le(i8* %7)
%15 = and i32 %14, 4095
%16 = add nuw nsw i32 %15, 8
%17 = zext i32 %16 to i64
%18 = getelementptr inbounds i8, i8* %7, i64 %17
%19 = tail call i32 @get_uint32le(i8* %18)
%20 = add nsw i32 %1, 536870912
%21 = tail call i32 @printf(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str, i64 0, i64 0), i32 %19)
%22 = add nsw i32 %1, 536870920
%23 = tail call i32 @printf(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.1, i64 0, i64 0), i32 %22)
%24 = tail call i32 @put_uint32le(i32 %19, i8* %12)
%25 = getelementptr inbounds i8, i8* %12, i64 4
%26 = tail call i32 @put_uint32le(i32 %20, i8* %25)
%27 = tail call i32 @put_uint32le(i32 %22, i8* %18)
%28 = tail call i32 @telechips_encode_crc(i8* %7, i32 %6)
store i32 %6, i32* %4
br label %29
29: ; preds = %5, %9
ret i8* %7
}