#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ buf;

/* Variables and functions */
scalar_t__ MAP_SHARED;
int /*<<< orphan*/ O_RDONLY;
scalar_t__ PROT_READ;
int __NR_mmap;
int /*<<< orphan*/ close(int /*<<< orphan*/);
scalar_t__ errno;
int getpid();
int open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, long);
int read(int, char *, int);
int /*<<< orphan*/ sprintf(char *, char *, int);
long syscall(long, long, long, long, long, long, long);
int /*<<< orphan*/ write(int, char *, int);
int main(int argc, char **argv) {
  long ofs = 0x12345670000;
  errno = 0;
  close(0);
  if (open("/etc/passwd", O_RDONLY))
    return 1;
  long r =
      syscall((long)(__NR_mmap | 0x40000000), (long)(0), (long)(0x10000),
              (long)(PROT_READ), (long)(MAP_SHARED), (long)(0), (long)(ofs));
  printf("ret:0x%lx errno:%m\n", r);
  char buf[16 * 1024];
  sprintf(buf, "/proc/%d/maps", getpid());
  int fd = open(buf, O_RDONLY);
  if (fd > 0) {
    int sz = read(fd, buf, sizeof(buf));
    if (sz > 0)
      write(1, buf, sz);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x4040,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movabs $0x12345670000,%rax
mov    %rax,-0x18(%rbp)
mov    0x2e12(%rip),%rax
movq   $0x0,(%rax)
xor    %edi,%edi
call   1060 <close@plt>
mov    0x2e0d(%rip),%rax
mov    (%rax),%esi
lea    0xe34(%rip),%rdi
call   1090 <open@plt>
cmp    $0x0,%eax
je     11e6 <main+0x66>
movl   $0x1,-0x4(%rbp)
jmp    12d8 <main+0x158>
mov    0x2deb(%rip),%rax
mov    (%rax),%eax
or     $0x40000000,%eax
movslq %eax,%rdi
mov    0x2dfa(%rip),%rax
mov    (%rax),%rcx
mov    0x2de0(%rip),%rax
mov    (%rax),%r8
mov    -0x18(%rbp),%rax
xor    %edx,%edx
mov    %edx,%r9d
mov    $0x10000,%edx
mov    %r9,%rsi
mov    %rax,(%rsp)
call   1080 <syscall@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rsi
lea    0xdd8(%rip),%rdi
call   1050 <printf@plt>
lea    -0x4020(%rbp),%rax
mov    %rax,-0x4030(%rbp)
mov    $0x0,%al
call   1040 <getpid@plt>
mov    -0x4030(%rbp),%rdi
mov    %eax,%edx
lea    0xdc2(%rip),%rsi
call   10a0 <sprintf@plt>
lea    -0x4020(%rbp),%rdi
mov    0x2d5f(%rip),%rax
mov    (%rax),%esi
call   1090 <open@plt>
mov    %eax,-0x4024(%rbp)
cmpl   $0x0,-0x4024(%rbp)
jle    12d1 <main+0x151>
mov    -0x4024(%rbp),%edi
lea    -0x4020(%rbp),%rsi
mov    $0x4000,%edx
call   1070 <read@plt>
mov    %eax,-0x4028(%rbp)
cmpl   $0x0,-0x4028(%rbp)
jle    12cc <main+0x14c>
lea    -0x4020(%rbp),%rsi
mov    -0x4028(%rbp),%edx
mov    $0x1,%edi
call   1030 <write@plt>
jmp    12d1 <main+0x151>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x4040,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %rbx
sub    $0x4010,%rsp
mov    0x2e2d(%rip),%rax
movq   $0x0,(%rax)
xor    %edi,%edi
call   1060 <close@plt>
mov    0x2e28(%rip),%r15
mov    (%r15),%esi
lea    0xe4e(%rip),%rdi
call   1090 <open@plt>
mov    $0x1,%ebx
test   %eax,%eax
jne    1269 <main+0xe9>
mov    0x2e0d(%rip),%rax
movslq (%rax),%rdi
or     $0x40000000,%rdi
mov    0x2e1c(%rip),%rax
mov    (%rax),%rcx
mov    0x2e02(%rip),%rax
mov    (%rax),%r8
movabs $0x12345670000,%rax
mov    %rax,(%rsp)
xor    %ebx,%ebx
mov    $0x10000,%edx
xor    %esi,%esi
xor    %r9d,%r9d
call   1080 <syscall@plt>
lea    0xdfd(%rip),%rdi
mov    %rax,%rsi
call   1050 <printf@plt>
xor    %eax,%eax
call   1040 <getpid@plt>
lea    0xdfb(%rip),%rsi
lea    0x10(%rsp),%r14
mov    %r14,%rdi
mov    %eax,%edx
call   10a0 <sprintf@plt>
mov    (%r15),%esi
mov    %r14,%rdi
call   1090 <open@plt>
test   %eax,%eax
jle    1269 <main+0xe9>
lea    0x10(%rsp),%rsi
mov    %eax,%edi
mov    $0x4000,%edx
call   1070 <read@plt>
test   %eax,%eax
jle    1269 <main+0xe9>
lea    0x10(%rsp),%rsi
mov    $0x1,%edi
mov    %eax,%edx
call   1030 <write@plt>
mov    %ebx,%eax
add    $0x4010,%rsp
pop    %rbx
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@errno = global i64 0
@.str = [12 x i8] c"/etc/passwd\00"
@O_RDONLY = global i32 0
@__NR_mmap = global i32 0
@PROT_READ = global i64 0
@MAP_SHARED = global i64 0
@.str.1 = [20 x i8] c"ret:0x%lx errno:%m\0A\00"
@.str.2 = [14 x i8] c"/proc/%d/maps\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i64
%7 = alloca i64
%8 = alloca [16384 x i8]
%9 = alloca i32
%10 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i64 1250999861248, i64* %6
store i64 0, i64* @errno
%11 = call i32 @close(i32 0)
%12 = load i32, i32* @O_RDONLY
%13 = call i32 @open(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str, i64 0, i64 0), i32 %12)
%14 = icmp ne i32 %13, 0
br i1 %14, label %15, label %16
15: ; preds = %2
store i32 1, i32* %3
br label %46
16: ; preds = %2
%17 = load i32, i32* @__NR_mmap
%18 = or i32 %17, 1073741824
%19 = sext i32 %18 to i64
%20 = load i64, i64* @PROT_READ
%21 = load i64, i64* @MAP_SHARED
%22 = load i64, i64* %6
%23 = call i64 @syscall(i64 %19, i64 0, i64 65536, i64 %20, i64 %21, i64 0, i64 %22)
store i64 %23, i64* %7
%24 = load i64, i64* %7
%25 = call i32 @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i64 %24)
%26 = getelementptr inbounds [16384 x i8], [16384 x i8]* %8, i64 0, i64 0
%27 = call i32 (...) @getpid()
%28 = call i32 @sprintf(i8* %26, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0), i32 %27)
%29 = getelementptr inbounds [16384 x i8], [16384 x i8]* %8, i64 0, i64 0
%30 = load i32, i32* @O_RDONLY
%31 = call i32 @open(i8* %29, i32 %30)
store i32 %31, i32* %9
%32 = load i32, i32* %9
%33 = icmp sgt i32 %32, 0
br i1 %33, label %34, label %45
34: ; preds = %16
%35 = load i32, i32* %9
%36 = getelementptr inbounds [16384 x i8], [16384 x i8]* %8, i64 0, i64 0
%37 = call i32 @read(i32 %35, i8* %36, i32 16384)
store i32 %37, i32* %10
%38 = load i32, i32* %10
%39 = icmp sgt i32 %38, 0
br i1 %39, label %40, label %44
40: ; preds = %34
%41 = getelementptr inbounds [16384 x i8], [16384 x i8]* %8, i64 0, i64 0
%42 = load i32, i32* %10
%43 = call i32 @write(i32 1, i8* %41, i32 %42)
br label %44
44: ; preds = %40, %34
br label %45
45: ; preds = %44, %16
store i32 0, i32* %3
br label %46
46: ; preds = %45, %15
%47 = load i32, i32* %3
ret i32 %47
}

LLVM IR (-O2):
@errno = global i64 0
@.str = [12 x i8] c"/etc/passwd\00"
@O_RDONLY = global i32 0
@__NR_mmap = global i32 0
@PROT_READ = global i64 0
@MAP_SHARED = global i64 0
@.str.1 = [20 x i8] c"ret:0x%lx errno:%m\0A\00"
@.str.2 = [14 x i8] c"/proc/%d/maps\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = alloca [16384 x i8]
store i64 0, i64* @errno
%4 = tail call i32 @close(i32 0)
%5 = load i32, i32* @O_RDONLY
%6 = tail call i32 @open(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str, i64 0, i64 0), i32 %5)
%7 = icmp eq i32 %6, 0
br i1 %7, label %8, label %28
8: ; preds = %2
%9 = load i32, i32* @__NR_mmap
%10 = or i32 %9, 1073741824
%11 = sext i32 %10 to i64
%12 = load i64, i64* @PROT_READ
%13 = load i64, i64* @MAP_SHARED
%14 = tail call i64 @syscall(i64 %11, i64 0, i64 65536, i64 %12, i64 %13, i64 0, i64 1250999861248)
%15 = tail call i32 @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.1, i64 0, i64 0), i64 %14)
%16 = getelementptr inbounds [16384 x i8], [16384 x i8]* %3, i64 0, i64 0
%17 = tail call i32 (...) @getpid()
%18 = call i32 @sprintf(i8* %16, i8* dereferenceable(1) getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0), i32 %17)
%19 = load i32, i32* @O_RDONLY
%20 = call i32 @open(i8* %16, i32 %19)
%21 = icmp sgt i32 %20, 0
br i1 %21, label %22, label %27
22: ; preds = %8
%23 = call i32 @read(i32 %20, i8* %16, i32 16384)
%24 = icmp sgt i32 %23, 0
br i1 %24, label %25, label %27
25: ; preds = %22
%26 = call i32 @write(i32 1, i8* %16, i32 %23)
br label %27
27: ; preds = %22, %25, %8
br label %28
28: ; preds = %2, %27
%29 = phi i32 [ 0, %27 ], [ 1, %2 ]
ret i32 %29
}