#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef unsigned char retaddr;
typedef unsigned char locaddr;

/* Variables and functions */
int /*<<< orphan*/ EXIT_FAILURE;
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, char *);
int snprintf(char *, int, char *, unsigned int, unsigned int, unsigned int,
             unsigned int, ...);
int build_hn(char *buf, unsigned int locaddr, unsigned int retaddr,
             unsigned int offset, unsigned int base) {
  unsigned char b0, b1, b2, b3;
  unsigned int high, low;
  int start = ((base / (0x100 * 0x100)) + 1) * 0x100 * 0x100;
  int sz;
  {
    b0 = (locaddr >> 24) & 0xff;
    b1 = (locaddr >> 16) & 0xff;
    b2 = (locaddr >> 8) & 0xff;
    b3 = (locaddr)&0xff;
    if (b0 * b1 * b2 * b3 == 0) {
      printf("\n%s contains a NUL byte. Leaving...\n", "[ locaddr ]");
      exit(EXIT_FAILURE);
    }
  };
  sz = snprintf(buf, sizeof(size_t) * 2 + 1,
                "%c%c%c%c"
                "%c%c%c%c",
                b3, b2, b1, b0, b3 + 2, b2, b1, b0);
  {
    b0 = (retaddr >> 24) & 0xff;
    b1 = (retaddr >> 16) & 0xff;
    b2 = (retaddr >> 8) & 0xff;
    b3 = (retaddr)&0xff;
    if (b0 * b1 * b2 * b3 == 0) {
      printf("\n%s contains a NUL byte. Leaving...\n", "[ retaddr ]");
      exit(EXIT_FAILURE);
    }
  };
  high = (retaddr & 0xffff0000) >> 16;
  low = retaddr & 0x0000ffff;
  return snprintf(buf + sz, 128, "%%.%hdx%%%d$n%%.%hdx%%%d$hn",
                  low - sizeof(size_t) * 2 + start - base, offset,
                  high - low + start, offset + 1);
}


x86 assembly (clang, -O0):
<build_hn>:
push   %rbp
mov    %rsp,%rbp
push   %r14
push   %rbx
sub    $0x60,%rsp
mov    %rdi,-0x18(%rbp)
mov    %esi,-0x1c(%rbp)
mov    %edx,-0x20(%rbp)
mov    %ecx,-0x24(%rbp)
mov    %r8d,-0x28(%rbp)
mov    -0x28(%rbp),%eax
shr    $0x10,%eax
add    $0x1,%eax
shl    $0x8,%eax
shl    $0x8,%eax
mov    %eax,-0x38(%rbp)
mov    -0x1c(%rbp),%eax
shr    $0x18,%eax
and    $0xff,%eax
mov    %al,-0x29(%rbp)
mov    -0x1c(%rbp),%eax
shr    $0x10,%eax
and    $0xff,%eax
mov    %al,-0x2a(%rbp)
mov    -0x1c(%rbp),%eax
shr    $0x8,%eax
and    $0xff,%eax
mov    %al,-0x2b(%rbp)
mov    -0x1c(%rbp),%eax
and    $0xff,%eax
mov    %al,-0x2c(%rbp)
movzbl -0x29(%rbp),%eax
movzbl -0x2a(%rbp),%ecx
imul   %ecx,%eax
movzbl -0x2b(%rbp),%ecx
imul   %ecx,%eax
movzbl -0x2c(%rbp),%ecx
imul   %ecx,%eax
cmp    $0x0,%eax
jne    11d6 <build_hn+0xa6>
lea    0xe44(%rip),%rdi
lea    0xe62(%rip),%rsi
call   1030 <printf@plt>
mov    0x2e11(%rip),%rax
mov    (%rax),%edi
call   1050 <exit@plt>
mov    -0x18(%rbp),%rdi
movzbl -0x2c(%rbp),%ecx
movzbl -0x2b(%rbp),%r8d
movzbl -0x2a(%rbp),%r9d
movzbl -0x29(%rbp),%r14d
movzbl -0x2c(%rbp),%ebx
add    $0x2,%ebx
movzbl -0x2b(%rbp),%r11d
movzbl -0x2a(%rbp),%r10d
movzbl -0x29(%rbp),%eax
mov    $0x11,%esi
lea    0xe23(%rip),%rdx
mov    %r14d,(%rsp)
mov    %ebx,0x8(%rsp)
mov    %r11d,0x10(%rsp)
mov    %r10d,0x18(%rsp)
mov    %eax,0x20(%rsp)
mov    $0x0,%al
call   1040 <snprintf@plt>
mov    %eax,-0x3c(%rbp)
mov    -0x20(%rbp),%eax
shr    $0x18,%eax
and    $0xff,%eax
mov    %al,-0x29(%rbp)
mov    -0x20(%rbp),%eax
shr    $0x10,%eax
and    $0xff,%eax
mov    %al,-0x2a(%rbp)
mov    -0x20(%rbp),%eax
shr    $0x8,%eax
and    $0xff,%eax
mov    %al,-0x2b(%rbp)
mov    -0x20(%rbp),%eax
and    $0xff,%eax
mov    %al,-0x2c(%rbp)
movzbl -0x29(%rbp),%eax
movzbl -0x2a(%rbp),%ecx
imul   %ecx,%eax
movzbl -0x2b(%rbp),%ecx
imul   %ecx,%eax
movzbl -0x2c(%rbp),%ecx
imul   %ecx,%eax
cmp    $0x0,%eax
jne    12a6 <build_hn+0x176>
lea    0xd74(%rip),%rdi
lea    0xdaf(%rip),%rsi
call   1030 <printf@plt>
mov    0x2d41(%rip),%rax
mov    (%rax),%edi
call   1050 <exit@plt>
mov    -0x20(%rbp),%eax
and    $0xffff0000,%eax
shr    $0x10,%eax
mov    %eax,-0x30(%rbp)
mov    -0x20(%rbp),%eax
and    $0xffff,%eax
mov    %eax,-0x34(%rbp)
mov    -0x18(%rbp),%rdi
movslq -0x3c(%rbp),%rax
add    %rax,%rdi
mov    -0x34(%rbp),%eax
sub    $0x10,%rax
movslq -0x38(%rbp),%rcx
add    %rcx,%rax
mov    -0x28(%rbp),%ecx
sub    %rcx,%rax
mov    %eax,%ecx
mov    -0x24(%rbp),%r8d
mov    -0x30(%rbp),%r9d
sub    -0x34(%rbp),%r9d
add    -0x38(%rbp),%r9d
mov    -0x24(%rbp),%eax
add    $0x1,%eax
mov    $0x80,%esi
lea    0xd4c(%rip),%rdx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1040 <snprintf@plt>
add    $0x60,%rsp
pop    %rbx
pop    %r14
pop    %rbp
ret

x86 assembly (clang, -O2):
<build_hn>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %ecx,%r14d
mov    %edx,%r13d
mov    %esi,%eax
mov    %esi,%edx
movzbl %ah,%ebp
movzbl %al,%ecx
mov    %esi,%ebx
shr    $0x18,%ebx
shr    $0x10,%edx
movzbl %dl,%r9d
mov    %ecx,%eax
imul   %ebx,%eax
mov    %r9d,%edx
imul   %ebp,%edx
imul   %eax,%edx
test   %edx,%edx
je     1217 <build_hn+0xe7>
mov    %r8d,%r15d
mov    %rdi,%r12
lea    0x2(%rcx),%r10d
sub    $0x8,%rsp
lea    0xeaf(%rip),%rdx
mov    $0x11,%esi
mov    %ebp,%r8d
xor    %eax,%eax
push   %rbx
push   %r9
push   %rbp
push   %r10
push   %rbx
call   1040 <snprintf@plt>
add    $0x30,%rsp
mov    %r13d,%ebx
mov    %r13d,%ecx
shr    $0x18,%ecx
mov    %r13d,%r9d
shr    $0x10,%r9d
movzbl %r9b,%edx
movzbl %bh,%esi
movzbl %bl,%edi
imul   %ecx,%edi
imul   %edx,%esi
imul   %edi,%esi
test   %esi,%esi
je     1227 <build_hn+0xf7>
lea    0x10000(%r15),%edx
and    $0xffff0000,%edx
movzwl %bx,%ecx
cltq
add    %rax,%r12
sub    %ecx,%r9d
sub    %r15d,%ecx
add    %edx,%ecx
add    $0xfffffff0,%ecx
add    %edx,%r9d
lea    0x1(%r14),%ebp
sub    $0x8,%rsp
lea    0xe59(%rip),%rdx
mov    %r12,%rdi
mov    $0x80,%esi
mov    %r14d,%r8d
xor    %eax,%eax
push   %rbp
call   1040 <snprintf@plt>
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xde2(%rip),%rdi
lea    0xe00(%rip),%rsi
jmp    1235 <build_hn+0x105>
lea    0xdd2(%rip),%rdi
lea    0xe0d(%rip),%rsi
call   1030 <printf@plt>
mov    0x2d9f(%rip),%rax
mov    (%rax),%edi
call   1050 <exit@plt>

LLVM IR (-O0):
@.str = [37 x i8] c"\0A%s contains a NUL byte. Leaving...\0A\00"
@.str.1 = [12 x i8] c"[ locaddr ]\00"
@EXIT_FAILURE = global i32 0
@.str.2 = [17 x i8] c"%c%c%c%c%c%c%c%c\00"
@.str.3 = [12 x i8] c"[ retaddr ]\00"
@.str.4 = [28 x i8] c"%%.%hdx%%%d$n%%.%hdx%%%d$hn\00"
define i32 @build_hn(i8* %0, i32 %1, i32 %2, i32 %3, i32 %4) {
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i8
%12 = alloca i8
%13 = alloca i8
%14 = alloca i8
%15 = alloca i32
%16 = alloca i32
%17 = alloca i32
%18 = alloca i32
store i8* %0, i8** %6
store i32 %1, i32* %7
store i32 %2, i32* %8
store i32 %3, i32* %9
store i32 %4, i32* %10
%19 = load i32, i32* %10
%20 = udiv i32 %19, 65536
%21 = add i32 %20, 1
%22 = mul i32 %21, 256
%23 = mul i32 %22, 256
store i32 %23, i32* %17
%24 = load i32, i32* %7
%25 = lshr i32 %24, 24
%26 = and i32 %25, 255
%27 = trunc i32 %26 to i8
store i8 %27, i8* %11
%28 = load i32, i32* %7
%29 = lshr i32 %28, 16
%30 = and i32 %29, 255
%31 = trunc i32 %30 to i8
store i8 %31, i8* %12
%32 = load i32, i32* %7
%33 = lshr i32 %32, 8
%34 = and i32 %33, 255
%35 = trunc i32 %34 to i8
store i8 %35, i8* %13
%36 = load i32, i32* %7
%37 = and i32 %36, 255
%38 = trunc i32 %37 to i8
store i8 %38, i8* %14
%39 = load i8, i8* %11
%40 = zext i8 %39 to i32
%41 = load i8, i8* %12
%42 = zext i8 %41 to i32
%43 = mul nsw i32 %40, %42
%44 = load i8, i8* %13
%45 = zext i8 %44 to i32
%46 = mul nsw i32 %43, %45
%47 = load i8, i8* %14
%48 = zext i8 %47 to i32
%49 = mul nsw i32 %46, %48
%50 = icmp eq i32 %49, 0
br i1 %50, label %51, label %55
51: ; preds = %5
%52 = call i32 @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.1, i64 0, i64 0))
%53 = load i32, i32* @EXIT_FAILURE
%54 = call i32 @exit(i32 %53)
unreachable
55: ; preds = %5
%56 = load i8*, i8** %6
%57 = load i8, i8* %14
%58 = zext i8 %57 to i32
%59 = load i8, i8* %13
%60 = zext i8 %59 to i32
%61 = load i8, i8* %12
%62 = zext i8 %61 to i32
%63 = load i8, i8* %11
%64 = zext i8 %63 to i32
%65 = load i8, i8* %14
%66 = zext i8 %65 to i32
%67 = add nsw i32 %66, 2
%68 = load i8, i8* %13
%69 = zext i8 %68 to i32
%70 = load i8, i8* %12
%71 = zext i8 %70 to i32
%72 = load i8, i8* %11
%73 = zext i8 %72 to i32
%74 = call i32 (i8*, i32, i8*, i32, i32, i32, i32, ...) @snprintf(i8* %56, i32 17, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.2, i64 0, i64 0), i32 %58, i32 %60, i32 %62, i32 %64, i32 %67, i32 %69, i32 %71, i32 %73)
store i32 %74, i32* %18
%75 = load i32, i32* %8
%76 = lshr i32 %75, 24
%77 = and i32 %76, 255
%78 = trunc i32 %77 to i8
store i8 %78, i8* %11
%79 = load i32, i32* %8
%80 = lshr i32 %79, 16
%81 = and i32 %80, 255
%82 = trunc i32 %81 to i8
store i8 %82, i8* %12
%83 = load i32, i32* %8
%84 = lshr i32 %83, 8
%85 = and i32 %84, 255
%86 = trunc i32 %85 to i8
store i8 %86, i8* %13
%87 = load i32, i32* %8
%88 = and i32 %87, 255
%89 = trunc i32 %88 to i8
store i8 %89, i8* %14
%90 = load i8, i8* %11
%91 = zext i8 %90 to i32
%92 = load i8, i8* %12
%93 = zext i8 %92 to i32
%94 = mul nsw i32 %91, %93
%95 = load i8, i8* %13
%96 = zext i8 %95 to i32
%97 = mul nsw i32 %94, %96
%98 = load i8, i8* %14
%99 = zext i8 %98 to i32
%100 = mul nsw i32 %97, %99
%101 = icmp eq i32 %100, 0
br i1 %101, label %102, label %106
102: ; preds = %55
%103 = call i32 @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.3, i64 0, i64 0))
%104 = load i32, i32* @EXIT_FAILURE
%105 = call i32 @exit(i32 %104)
unreachable
106: ; preds = %55
%107 = load i32, i32* %8
%108 = and i32 %107, -65536
%109 = lshr i32 %108, 16
store i32 %109, i32* %15
%110 = load i32, i32* %8
%111 = and i32 %110, 65535
store i32 %111, i32* %16
%112 = load i8*, i8** %6
%113 = load i32, i32* %18
%114 = sext i32 %113 to i64
%115 = getelementptr inbounds i8, i8* %112, i64 %114
%116 = load i32, i32* %16
%117 = zext i32 %116 to i64
%118 = sub i64 %117, 16
%119 = load i32, i32* %17
%120 = sext i32 %119 to i64
%121 = add i64 %118, %120
%122 = load i32, i32* %10
%123 = zext i32 %122 to i64
%124 = sub i64 %121, %123
%125 = trunc i64 %124 to i32
%126 = load i32, i32* %9
%127 = load i32, i32* %15
%128 = load i32, i32* %16
%129 = sub i32 %127, %128
%130 = load i32, i32* %17
%131 = add i32 %129, %130
%132 = load i32, i32* %9
%133 = add i32 %132, 1
%134 = call i32 (i8*, i32, i8*, i32, i32, i32, i32, ...) @snprintf(i8* %115, i32 128, i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.4, i64 0, i64 0), i32 %125, i32 %126, i32 %131, i32 %133)
ret i32 %134
}

LLVM IR (-O2):
@.str = [37 x i8] c"\0A%s contains a NUL byte. Leaving...\0A\00"
@.str.1 = [12 x i8] c"[ locaddr ]\00"
@EXIT_FAILURE = global i32 0
@.str.2 = [17 x i8] c"%c%c%c%c%c%c%c%c\00"
@.str.3 = [12 x i8] c"[ retaddr ]\00"
@.str.4 = [28 x i8] c"%%.%hdx%%%d$n%%.%hdx%%%d$hn\00"
define i32 @build_hn(i8* %0, i32 %1, i32 %2, i32 %3, i32 %4) {
%6 = add i32 %4, 65536
%7 = and i32 %6, -65536
%8 = lshr i32 %1, 24
%9 = lshr i32 %1, 16
%10 = lshr i32 %1, 8
%11 = and i32 %9, 255
%12 = and i32 %10, 255
%13 = and i32 %1, 255
%14 = mul nuw nsw i32 %13, %8
%15 = mul nuw nsw i32 %14, %11
%16 = mul nuw i32 %15, %12
%17 = icmp eq i32 %16, 0
br i1 %17, label %18, label %22
18: ; preds = %5
%19 = tail call i32 @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.1, i64 0, i64 0))
%20 = load i32, i32* @EXIT_FAILURE
%21 = tail call i32 @exit(i32 %20)
unreachable
22: ; preds = %5
%23 = add nuw nsw i32 %13, 2
%24 = tail call i32 (i8*, i32, i8*, i32, i32, i32, i32, ...) @snprintf(i8* %0, i32 17, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.2, i64 0, i64 0), i32 %13, i32 %12, i32 %11, i32 %8, i32 %23, i32 %12, i32 %11, i32 %8)
%25 = lshr i32 %2, 24
%26 = lshr i32 %2, 16
%27 = lshr i32 %2, 8
%28 = and i32 %26, 255
%29 = and i32 %27, 255
%30 = and i32 %2, 255
%31 = mul nuw nsw i32 %30, %25
%32 = mul nuw nsw i32 %31, %28
%33 = mul nuw i32 %32, %29
%34 = icmp eq i32 %33, 0
br i1 %34, label %35, label %39
35: ; preds = %22
%36 = tail call i32 @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.3, i64 0, i64 0))
%37 = load i32, i32* @EXIT_FAILURE
%38 = tail call i32 @exit(i32 %37)
unreachable
39: ; preds = %22
%40 = and i32 %2, 65535
%41 = sext i32 %24 to i64
%42 = getelementptr inbounds i8, i8* %0, i64 %41
%43 = add nsw i32 %40, -16
%44 = sub i32 %43, %4
%45 = add i32 %44, %7
%46 = sub nsw i32 %26, %40
%47 = add i32 %46, %7
%48 = add i32 %3, 1
%49 = tail call i32 (i8*, i32, i8*, i32, i32, i32, i32, ...) @snprintf(i8* %42, i32 128, i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.4, i64 0, i64 0), i32 %45, i32 %3, i32 %47, i32 %48)
ret i32 %49
}