#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
char *memalign(int, int);
int /*<<< orphan*/ memcpy(char *, char *, int);
int /*<<< orphan*/ memset(char *, int /*<<< orphan*/, int);
int /*<<< orphan*/ mprotect(char *, int, int);
int runShellcode(char *sc, int size) {
  void (*fun)();
  char *shellcode;
  shellcode = memalign(4096, 4096);
  mprotect(shellcode, 4096, PROT_READ | PROT_WRITE | PROT_EXEC);
  memset(shellcode, 0, 4096);
  memcpy(shellcode, sc, size);
  fun = (void (*)())shellcode;
  fun();
  return 0;
}


x86 assembly (clang, -O0):
<runShellcode>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %rdi,-0x8(%rbp)
mov    %esi,-0xc(%rbp)
mov    $0x1000,%esi
mov    %esi,%edi
call   1050 <memalign@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rdi
mov    0x2e8e(%rip),%rax
mov    (%rax),%edx
mov    0x2e5d(%rip),%rax
or     (%rax),%edx
mov    0x2e64(%rip),%rax
or     (%rax),%edx
mov    $0x1000,%esi
call   1060 <mprotect@plt>
mov    -0x20(%rbp),%rdi
xor    %esi,%esi
mov    $0x1000,%edx
call   1030 <memset@plt>
mov    -0x20(%rbp),%rdi
mov    -0x8(%rbp),%rsi
mov    -0xc(%rbp),%edx
call   1040 <memcpy@plt>
mov    -0x20(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    $0x0,%al
call   *-0x18(%rbp)
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<runShellcode>:
push   %rbp
push   %r14
push   %rbx
mov    %esi,%r14d
mov    %rdi,%rbx
mov    $0x1000,%edi
mov    $0x1000,%esi
call   1050 <memalign@plt>
mov    0x2e98(%rip),%rcx
mov    0x2e69(%rip),%rdx
mov    (%rdx),%edx
or     (%rcx),%edx
mov    %rax,%rbp
mov    0x2e6b(%rip),%rax
or     (%rax),%edx
mov    %rbp,%rdi
mov    $0x1000,%esi
call   1060 <mprotect@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    $0x1000,%edx
call   1030 <memset@plt>
mov    %rbp,%rdi
mov    %rbx,%rsi
mov    %r14d,%edx
call   1040 <memcpy@plt>
xor    %eax,%eax
call   *%rbp
xor    %eax,%eax
pop    %rbx
pop    %r14
pop    %rbp
ret

LLVM IR (-O0):
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
define i32 @runShellcode(i8* %0, i32 %1) {
%3 = alloca i8*
%4 = alloca i32
%5 = alloca void (...)*
%6 = alloca i8*
store i8* %0, i8** %3
store i32 %1, i32* %4
%7 = call i8* @memalign(i32 4096, i32 4096)
store i8* %7, i8** %6
%8 = load i8*, i8** %6
%9 = load i32, i32* @PROT_READ
%10 = load i32, i32* @PROT_WRITE
%11 = or i32 %9, %10
%12 = load i32, i32* @PROT_EXEC
%13 = or i32 %11, %12
%14 = call i32 @mprotect(i8* %8, i32 4096, i32 %13)
%15 = load i8*, i8** %6
%16 = call i32 @memset(i8* %15, i32 0, i32 4096)
%17 = load i8*, i8** %6
%18 = load i8*, i8** %3
%19 = load i32, i32* %4
%20 = call i32 @memcpy(i8* %17, i8* %18, i32 %19)
%21 = load i8*, i8** %6
%22 = bitcast i8* %21 to void (...)*
store void (...)* %22, void (...)** %5
%23 = load void (...)*, void (...)** %5
ret i32 0
}

LLVM IR (-O2):
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
define i32 @runShellcode(i8* %0, i32 %1) {
%3 = tail call align 4096 dereferenceable_or_null(4096) i8* @memalign(i32 4096, i32 4096)
%4 = load i32, i32* @PROT_READ
%5 = load i32, i32* @PROT_WRITE
%6 = or i32 %5, %4
%7 = load i32, i32* @PROT_EXEC
%8 = or i32 %6, %7
%9 = tail call i32 @mprotect(i8* %3, i32 4096, i32 %8)
%10 = tail call i32 @memset(i8* %3, i32 0, i32 4096)
%11 = tail call i32 @memcpy(i8* %3, i8* %0, i32 %1)
%12 = bitcast i8* %3 to void (...)*
tail call void (...) %12()
ret i32 0
}