#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ SEEK_SET;
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char *, char *);
int /*<<< orphan*/ fread(unsigned char *, int, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ fseek(int /*<<< orphan*/ *, int, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, ...);
int main(void) {
  FILE *f;
  int i;
  unsigned char c[0x21];
  f = fopen("/dev/mem", "r");
  if (f == NULL) {
    printf("You must have read access to /dev/mem to execute this.\n");
    return 1;
  }
  for (i = 0xc0000; i < 0xf0000; i += 0x800) {
    fseek(f, i, SEEK_SET);
    fread(c, 0x21, 1, f);
    if (c[0] == 0x55 && c[1] == 0xaa && c[0x1e] == 'I' && c[0x1f] == 'B' &&
        c[0x20] == 'M') {
      printf("$_vbios_seg = (0x%x)\n", i >> 4);
      printf("$_vbios_size = (0x%x)\n", c[2] * 0x200);
    }
  }
  fclose(f);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
movl   $0x0,-0x4(%rbp)
lea    0xe9a(%rip),%rdi
lea    0xe9c(%rip),%rsi
call   1070 <fopen@plt>
mov    %rax,-0x10(%rbp)
cmpq   $0x0,-0x10(%rbp)
jne    119b <main+0x4b>
lea    0xe83(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    126c <main+0x11c>
movl   $0xc0000,-0x14(%rbp)
cmpl   $0xf0000,-0x14(%rbp)
jge    125c <main+0x10c>
mov    -0x10(%rbp),%rdi
mov    -0x14(%rbp),%esi
mov    0x2e23(%rip),%rax
mov    (%rax),%edx
call   1060 <fseek@plt>
lea    -0x40(%rbp),%rdi
mov    -0x10(%rbp),%rcx
mov    $0x21,%esi
mov    $0x1,%edx
call   1030 <fread@plt>
movzbl -0x40(%rbp),%eax
cmp    $0x55,%eax
jne    1247 <main+0xf7>
movzbl -0x3f(%rbp),%eax
cmp    $0xaa,%eax
jne    1247 <main+0xf7>
movzbl -0x22(%rbp),%eax
cmp    $0x49,%eax
jne    1247 <main+0xf7>
movzbl -0x21(%rbp),%eax
cmp    $0x42,%eax
jne    1247 <main+0xf7>
movzbl -0x20(%rbp),%eax
cmp    $0x4d,%eax
jne    1247 <main+0xf7>
mov    -0x14(%rbp),%esi
sar    $0x4,%esi
lea    0xe18(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
movzbl -0x3e(%rbp),%esi
shl    $0x9,%esi
lea    0xe19(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
jmp    124c <main+0xfc>
mov    -0x14(%rbp),%eax
add    $0x800,%eax
mov    %eax,-0x14(%rbp)
jmp    11a2 <main+0x52>
mov    -0x10(%rbp),%rdi
call   1040 <fclose@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x28,%rsp
lea    0xe8b(%rip),%rdi
lea    0xe8d(%rip),%rsi
call   1080 <fopen@plt>
test   %rax,%rax
je     1236 <main+0xd6>
mov    %rax,%r14
mov    $0xbf800,%ebp
mov    $0xc000,%ebx
mov    0x2e42(%rip),%r12
mov    %rsp,%r15
lea    0xe79(%rip),%r13
jmp    11bb <main+0x5b>
nopw   0x0(%rax,%rax,1)
sub    $0xffffff80,%ebx
cmp    $0xef800,%ebp
jae    122a <main+0xca>
add    $0x800,%ebp
mov    (%r12),%edx
mov    %r14,%rdi
mov    %ebp,%esi
call   1070 <fseek@plt>
mov    %r15,%rdi
mov    $0x21,%esi
mov    $0x1,%edx
mov    %r14,%rcx
call   1040 <fread@plt>
cmpb   $0x55,(%rsp)
jne    11b0 <main+0x50>
cmpb   $0xaa,0x1(%rsp)
jne    11b0 <main+0x50>
cmpb   $0x49,0x1e(%rsp)
jne    11b0 <main+0x50>
cmpb   $0x42,0x1f(%rsp)
jne    11b0 <main+0x50>
cmpb   $0x4d,0x20(%rsp)
jne    11b0 <main+0x50>
lea    0xdfe(%rip),%rdi
mov    %ebx,%esi
xor    %eax,%eax
call   1060 <printf@plt>
movzbl 0x2(%rsp),%esi
shl    $0x9,%esi
mov    %r13,%rdi
xor    %eax,%eax
call   1060 <printf@plt>
jmp    11b0 <main+0x50>
mov    %r14,%rdi
call   1050 <fclose@plt>
xor    %eax,%eax
jmp    1247 <main+0xe7>
lea    0xdfb(%rip),%rdi
call   1030 <puts@plt>
mov    $0x1,%eax
add    $0x28,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [9 x i8] c"/dev/mem\00"
@.str.1 = [2 x i8] c"r\00"
@.str.2 = [56 x i8] c"You must have read access to /dev/mem to execute this.\0A\00"
@SEEK_SET = global i32 0
@.str.3 = [22 x i8] c"$_vbios_seg = (0x%x)\0A\00"
@.str.4 = [23 x i8] c"$_vbios_size = (0x%x)\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32*
%3 = alloca i32
%4 = alloca [33 x i8]
store i32 0, i32* %1
%5 = call i32* @fopen(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
store i32* %5, i32** %2
%6 = load i32*, i32** %2
%7 = icmp eq i32* %6, null
br i1 %7, label %8, label %10
8: ; preds = %0
%9 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([56 x i8], [56 x i8]* @.str.2, i64 0, i64 0))
store i32 1, i32* %1
br label %62
10: ; preds = %0
store i32 786432, i32* %3
br label %11
11: ; preds = %56, %10
%12 = load i32, i32* %3
%13 = icmp slt i32 %12, 983040
br i1 %13, label %14, label %59
14: ; preds = %11
%15 = load i32*, i32** %2
%16 = load i32, i32* %3
%17 = load i32, i32* @SEEK_SET
%18 = call i32 @fseek(i32* %15, i32 %16, i32 %17)
%19 = getelementptr inbounds [33 x i8], [33 x i8]* %4, i64 0, i64 0
%20 = load i32*, i32** %2
%21 = call i32 @fread(i8* %19, i32 33, i32 1, i32* %20)
%22 = getelementptr inbounds [33 x i8], [33 x i8]* %4, i64 0, i64 0
%23 = load i8, i8* %22
%24 = zext i8 %23 to i32
%25 = icmp eq i32 %24, 85
br i1 %25, label %26, label %55
26: ; preds = %14
%27 = getelementptr inbounds [33 x i8], [33 x i8]* %4, i64 0, i64 1
%28 = load i8, i8* %27
%29 = zext i8 %28 to i32
%30 = icmp eq i32 %29, 170
br i1 %30, label %31, label %55
31: ; preds = %26
%32 = getelementptr inbounds [33 x i8], [33 x i8]* %4, i64 0, i64 30
%33 = load i8, i8* %32
%34 = zext i8 %33 to i32
%35 = icmp eq i32 %34, 73
br i1 %35, label %36, label %55
36: ; preds = %31
%37 = getelementptr inbounds [33 x i8], [33 x i8]* %4, i64 0, i64 31
%38 = load i8, i8* %37
%39 = zext i8 %38 to i32
%40 = icmp eq i32 %39, 66
br i1 %40, label %41, label %55
41: ; preds = %36
%42 = getelementptr inbounds [33 x i8], [33 x i8]* %4, i64 0, i64 32
%43 = load i8, i8* %42
%44 = zext i8 %43 to i32
%45 = icmp eq i32 %44, 77
br i1 %45, label %46, label %55
46: ; preds = %41
%47 = load i32, i32* %3
%48 = ashr i32 %47, 4
%49 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.3, i64 0, i64 0), i32 %48)
%50 = getelementptr inbounds [33 x i8], [33 x i8]* %4, i64 0, i64 2
%51 = load i8, i8* %50
%52 = zext i8 %51 to i32
%53 = mul nsw i32 %52, 512
%54 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.4, i64 0, i64 0), i32 %53)
br label %55
55: ; preds = %46, %41, %36, %31, %26, %14
br label %56
56: ; preds = %55
%57 = load i32, i32* %3
%58 = add nsw i32 %57, 2048
store i32 %58, i32* %3
br label %11
59: ; preds = %11
%60 = load i32*, i32** %2
%61 = call i32 @fclose(i32* %60)
store i32 0, i32* %1
br label %62
62: ; preds = %59, %8
%63 = load i32, i32* %1
ret i32 %63
}

LLVM IR (-O2):
@.str = [9 x i8] c"/dev/mem\00"
@.str.1 = [2 x i8] c"r\00"
@SEEK_SET = global i32 0
@.str.3 = [22 x i8] c"$_vbios_seg = (0x%x)\0A\00"
@.str.4 = [23 x i8] c"$_vbios_size = (0x%x)\0A\00"
@str = [55 x i8] c"You must have read access to /dev/mem to execute this.\00"
define i32 @main() {
%1 = alloca [33 x i8]
%2 = getelementptr inbounds [33 x i8], [33 x i8]* %1, i64 0, i64 0
%3 = tail call i32* @fopen(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
%4 = icmp eq i32* %3, null
br i1 %4, label %11, label %5
5: ; preds = %0
%6 = getelementptr inbounds [33 x i8], [33 x i8]* %1, i64 0, i64 1
%7 = getelementptr inbounds [33 x i8], [33 x i8]* %1, i64 0, i64 30
%8 = getelementptr inbounds [33 x i8], [33 x i8]* %1, i64 0, i64 31
%9 = getelementptr inbounds [33 x i8], [33 x i8]* %1, i64 0, i64 32
%10 = getelementptr inbounds [33 x i8], [33 x i8]* %1, i64 0, i64 2
br label %13
11: ; preds = %0
%12 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([55 x i8], [55 x i8]* @str, i64 0, i64 0))
br label %44
13: ; preds = %5, %39
%14 = phi i32 [ 786432, %5 ], [ %40, %39 ]
%15 = load i32, i32* @SEEK_SET
%16 = tail call i32 @fseek(i32* %3, i32 %14, i32 %15)
%17 = call i32 @fread(i8* %2, i32 33, i32 1, i32* %3)
%18 = load i8, i8* %2
%19 = icmp eq i8 %18, 85
%20 = load i8, i8* %6
%21 = icmp eq i8 %20, -86
%22 = select i1 %19, i1 %21, i1 false
%23 = load i8, i8* %7
%24 = icmp eq i8 %23, 73
%25 = select i1 %22, i1 %24, i1 false
%26 = load i8, i8* %8
%27 = icmp eq i8 %26, 66
%28 = select i1 %25, i1 %27, i1 false
%29 = load i8, i8* %9
%30 = icmp eq i8 %29, 77
%31 = select i1 %28, i1 %30, i1 false
br i1 %31, label %32, label %39
32: ; preds = %13
%33 = lshr exact i32 %14, 4
%34 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @.str.3, i64 0, i64 0), i32 %33)
%35 = load i8, i8* %10
%36 = zext i8 %35 to i32
%37 = shl nuw nsw i32 %36, 9
%38 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.4, i64 0, i64 0), i32 %37)
br label %39
39: ; preds = %13, %32
%40 = add nuw nsw i32 %14, 2048
%41 = icmp ult i32 %14, 980992
br i1 %41, label %13, label %42
42: ; preds = %39
%43 = tail call i32 @fclose(i32* %3)
br label %44
44: ; preds = %42, %11
%45 = phi i32 [ 1, %11 ], [ 0, %42 ]
ret i32 %45
}