#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ szBuf;

/* Variables and functions */
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
char *memalign(int, int);
int /*<<< orphan*/ memcpy(char *, char *, int);
int /*<<< orphan*/ memset(char *, int /*<<< orphan*/, int);
int /*<<< orphan*/ mprotect(char *, int, int);
int recv_data(int, char *, int);
int vfunc(int fd) {
  void (*fun)();
  char *shellcode;
  char szBuf[4096] = {
      0x00,
  };
  int f, rv;
  f = fd;
  shellcode = memalign(4096, 4096);
  mprotect(shellcode, 4096, PROT_READ | PROT_WRITE | PROT_EXEC);
  memset(shellcode, 0, 4096);
  memset(szBuf, 0, sizeof(szBuf));
  rv = recv_data(f, szBuf, sizeof(szBuf));
  if (rv < 0) {
    return -1;
  }
  memcpy(shellcode, szBuf, rv);
  fun = (void (*)())shellcode;
  fun();
  return 0;
}


x86 assembly (clang, -O0):
<vfunc>:
push   %rbp
mov    %rsp,%rbp
sub    $0x1030,%rsp
mov    %edi,-0x8(%rbp)
lea    -0x1020(%rbp),%rdi
xor    %esi,%esi
mov    $0x1000,%edx
call   1040 <memset@plt>
mov    -0x8(%rbp),%eax
mov    %eax,-0x1024(%rbp)
mov    $0x1000,%esi
mov    %esi,%edi
call   1060 <memalign@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rdi
mov    0x2e63(%rip),%rax
mov    (%rax),%edx
mov    0x2e32(%rip),%rax
or     (%rax),%edx
mov    0x2e39(%rip),%rax
or     (%rax),%edx
mov    $0x1000,%esi
call   1070 <mprotect@plt>
mov    -0x18(%rbp),%rdi
xor    %esi,%esi
mov    $0x1000,%edx
call   1040 <memset@plt>
lea    -0x1020(%rbp),%rdi
xor    %esi,%esi
mov    $0x1000,%edx
call   1040 <memset@plt>
mov    -0x1024(%rbp),%edi
lea    -0x1020(%rbp),%rsi
mov    $0x1000,%edx
call   1030 <recv_data@plt>
mov    %eax,-0x1028(%rbp)
cmpl   $0x0,-0x1028(%rbp)
jge    120c <vfunc+0xbc>
movl   $0xffffffff,-0x4(%rbp)
jmp    1236 <vfunc+0xe6>
mov    -0x18(%rbp),%rdi
lea    -0x1020(%rbp),%rsi
mov    -0x1028(%rbp),%edx
call   1050 <memcpy@plt>
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    $0x0,%al
call   *-0x10(%rbp)
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x1030,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<vfunc>:
push   %rbp
push   %r15
push   %r14
push   %rbx
sub    $0x1008,%rsp
mov    %edi,%r15d
mov    %rsp,%rbp
xor    %r14d,%r14d
mov    $0x1000,%edx
mov    %rbp,%rdi
xor    %esi,%esi
call   1040 <memset@plt>
mov    $0x1000,%edi
mov    $0x1000,%esi
call   1060 <memalign@plt>
mov    0x2e6d(%rip),%rcx
mov    0x2e3e(%rip),%rdx
mov    (%rdx),%edx
or     (%rcx),%edx
mov    %rax,%rbx
mov    0x2e40(%rip),%rax
or     (%rax),%edx
mov    %rbx,%rdi
mov    $0x1000,%esi
call   1070 <mprotect@plt>
mov    %rbx,%rdi
xor    %esi,%esi
mov    $0x1000,%edx
call   1040 <memset@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    $0x1000,%edx
call   1040 <memset@plt>
mov    %r15d,%edi
mov    %rbp,%rsi
mov    $0x1000,%edx
call   1030 <recv_data@plt>
test   %eax,%eax
js     11f4 <vfunc+0xa4>
mov    %rsp,%rsi
mov    %rbx,%rdi
mov    %eax,%edx
call   1050 <memcpy@plt>
xor    %eax,%eax
call   *%rbx
jmp    11fa <vfunc+0xaa>
mov    $0xffffffff,%r14d
mov    %r14d,%eax
add    $0x1008,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
define i32 @vfunc(i32 %0) {
%2 = alloca i32
%3 = alloca i32
%4 = alloca void (...)*
%5 = alloca i8*
%6 = alloca [4096 x i8]
%7 = alloca i32
%8 = alloca i32
store i32 %0, i32* %3
%9 = bitcast [4096 x i8]* %6 to i8*
%10 = load i32, i32* %3
store i32 %10, i32* %7
%11 = call i8* @memalign(i32 4096, i32 4096)
store i8* %11, i8** %5
%12 = load i8*, i8** %5
%13 = load i32, i32* @PROT_READ
%14 = load i32, i32* @PROT_WRITE
%15 = or i32 %13, %14
%16 = load i32, i32* @PROT_EXEC
%17 = or i32 %15, %16
%18 = call i32 @mprotect(i8* %12, i32 4096, i32 %17)
%19 = load i8*, i8** %5
%20 = call i32 @memset(i8* %19, i32 0, i32 4096)
%21 = getelementptr inbounds [4096 x i8], [4096 x i8]* %6, i64 0, i64 0
%22 = call i32 @memset(i8* %21, i32 0, i32 4096)
%23 = load i32, i32* %7
%24 = getelementptr inbounds [4096 x i8], [4096 x i8]* %6, i64 0, i64 0
%25 = call i32 @recv_data(i32 %23, i8* %24, i32 4096)
store i32 %25, i32* %8
%26 = load i32, i32* %8
%27 = icmp slt i32 %26, 0
br i1 %27, label %28, label %29
28: ; preds = %1
store i32 -1, i32* %2
br label %37
29: ; preds = %1
%30 = load i8*, i8** %5
%31 = getelementptr inbounds [4096 x i8], [4096 x i8]* %6, i64 0, i64 0
%32 = load i32, i32* %8
%33 = call i32 @memcpy(i8* %30, i8* %31, i32 %32)
%34 = load i8*, i8** %5
%35 = bitcast i8* %34 to void (...)*
store void (...)* %35, void (...)** %4
%36 = load void (...)*, void (...)** %4
store i32 0, i32* %2
br label %37
37: ; preds = %29, %28
%38 = load i32, i32* %2
ret i32 %38
}

LLVM IR (-O2):
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
define i32 @vfunc(i32 %0) {
%2 = alloca [4096 x i8]
%3 = getelementptr inbounds [4096 x i8], [4096 x i8]* %2, i64 0, i64 0
%4 = tail call align 4096 dereferenceable_or_null(4096) i8* @memalign(i32 4096, i32 4096)
%5 = load i32, i32* @PROT_READ
%6 = load i32, i32* @PROT_WRITE
%7 = or i32 %6, %5
%8 = load i32, i32* @PROT_EXEC
%9 = or i32 %7, %8
%10 = tail call i32 @mprotect(i8* %4, i32 4096, i32 %9)
%11 = tail call i32 @memset(i8* %4, i32 0, i32 4096)
%12 = call i32 @memset(i8* %3, i32 0, i32 4096)
%13 = call i32 @recv_data(i32 %0, i8* %3, i32 4096)
%14 = icmp slt i32 %13, 0
br i1 %14, label %18, label %15
15: ; preds = %1
%16 = call i32 @memcpy(i8* %4, i8* %3, i32 %13)
%17 = bitcast i8* %4 to void (...)*
br label %18
18: ; preds = %1, %15
%19 = phi i32 [ 0, %15 ], [ -1, %1 ]
ret i32 %19
}