#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int O_CREAT;
int O_TRUNC;
int O_WRONLY;
int /*<<< orphan*/ close(int);
unsigned char *file_read(char *, int *);
int /*<<< orphan*/ free(unsigned char *);
unsigned char *malloc(int);
int open(char *, int, int);
unsigned char *patch_firmware_tcc(unsigned char *, int, unsigned char *, int,
                                  int *);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, ...);
scalar_t__ test_firmware_tcc(unsigned char *, int);
int /*<<< orphan*/ usage();
int write(int, unsigned char *, int);
int main(int argc, char *argv[]) {
  char *infile, *bootfile, *outfile;
  int fdout = -1;
  int n, of_size, boot_size, patched_size;
  unsigned char *of_buf;
  unsigned char *boot_buf = NULL;
  unsigned char *image = NULL;
  int ret = 0;
  if (argc < 3) {
    usage();
  }
  infile = argv[1];
  bootfile = argv[2];
  outfile = argv[3];
  of_buf = file_read(infile, &of_size);
  if (!of_buf) {
    ret = 1;
    goto error_exit;
  }
  if (test_firmware_tcc(of_buf, of_size)) {
    printf("[ERR] Unknown OF file used, aborting\n");
    ret = 2;
    goto error_exit;
  }
  boot_buf = file_read(bootfile, &boot_size);
  if (!boot_buf) {
    ret = 3;
    goto error_exit;
  }
  image = malloc(of_size + boot_size);
  if (image == NULL) {
    printf("[ERR] Could not allocate memory, aborting\n");
    ret = 4;
    goto error_exit;
  }
  image =
      patch_firmware_tcc(of_buf, of_size, boot_buf, boot_size, &patched_size);
  if (!image) {
    printf("[ERR] Error creating patched firmware, aborting\n");
    ret = 5;
    goto error_exit;
  }
  fdout = open(outfile, O_WRONLY | O_CREAT | O_TRUNC | 0, 0644);
  if (fdout < 0) {
    perror(outfile);
    ret = 6;
    goto error_exit;
  }
  n = write(fdout, image, patched_size);
  if (n != patched_size) {
    printf("[ERR] Could not write output file %s\n", outfile);
    ret = 7;
    goto error_exit;
  }
error_exit:
  if (fdout >= 0)
    close(fdout);
  if (of_buf)
    free(of_buf);
  if (boot_buf)
    free(boot_buf);
  if (image)
    free(image);
  return ret;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0xffffffff,-0x2c(%rbp)
movq   $0x0,-0x50(%rbp)
movq   $0x0,-0x58(%rbp)
movl   $0x0,-0x5c(%rbp)
cmpl   $0x3,-0x8(%rbp)
jge    11f5 <main+0x45>
mov    $0x0,%al
call   10a0 <usage@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rax
mov    %rax,-0x20(%rbp)
mov    -0x10(%rbp),%rax
mov    0x18(%rax),%rax
mov    %rax,-0x28(%rbp)
mov    -0x18(%rbp),%rdi
lea    -0x34(%rbp),%rsi
call   10c0 <file_read@plt>
mov    %rax,-0x48(%rbp)
cmpq   $0x0,-0x48(%rbp)
jne    1241 <main+0x91>
movl   $0x1,-0x5c(%rbp)
jmp    139c <main+0x1ec>
mov    -0x48(%rbp),%rdi
mov    -0x34(%rbp),%esi
call   1070 <test_firmware_tcc@plt>
cmp    $0x0,%rax
je     1271 <main+0xc1>
lea    0xda2(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movl   $0x2,-0x5c(%rbp)
jmp    139c <main+0x1ec>
mov    -0x20(%rbp),%rdi
lea    -0x38(%rbp),%rsi
call   10c0 <file_read@plt>
mov    %rax,-0x50(%rbp)
cmpq   $0x0,-0x50(%rbp)
jne    1299 <main+0xe9>
movl   $0x3,-0x5c(%rbp)
jmp    139c <main+0x1ec>
mov    -0x34(%rbp),%edi
add    -0x38(%rbp),%edi
call   1090 <malloc@plt>
mov    %rax,-0x58(%rbp)
cmpq   $0x0,-0x58(%rbp)
jne    12cd <main+0x11d>
lea    0xd6c(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movl   $0x4,-0x5c(%rbp)
jmp    139c <main+0x1ec>
mov    -0x48(%rbp),%rdi
mov    -0x34(%rbp),%esi
mov    -0x50(%rbp),%rdx
mov    -0x38(%rbp),%ecx
lea    -0x3c(%rbp),%r8
call   1040 <patch_firmware_tcc@plt>
mov    %rax,-0x58(%rbp)
cmpq   $0x0,-0x58(%rbp)
jne    130d <main+0x15d>
lea    0xd57(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movl   $0x5,-0x5c(%rbp)
jmp    139c <main+0x1ec>
mov    -0x28(%rbp),%rdi
mov    0x2cb0(%rip),%rax
mov    (%rax),%esi
mov    0x2cd7(%rip),%rax
or     (%rax),%esi
mov    0x2cc6(%rip),%rax
or     (%rax),%esi
or     $0x0,%esi
mov    $0x1a4,%edx
call   10b0 <open@plt>
mov    %eax,-0x2c(%rbp)
cmpl   $0x0,-0x2c(%rbp)
jge    135b <main+0x1ab>
mov    -0x28(%rbp),%rdi
call   10d0 <perror@plt>
movl   $0x6,-0x5c(%rbp)
jmp    139c <main+0x1ec>
mov    -0x2c(%rbp),%edi
mov    -0x58(%rbp),%rsi
mov    -0x3c(%rbp),%edx
call   1050 <write@plt>
mov    %eax,-0x30(%rbp)
mov    -0x30(%rbp),%eax
cmp    -0x3c(%rbp),%eax
je     1397 <main+0x1e7>
mov    -0x28(%rbp),%rsi
lea    0xcfe(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movl   $0x7,-0x5c(%rbp)
jmp    139c <main+0x1ec>
jmp    139c <main+0x1ec>
cmpl   $0x0,-0x2c(%rbp)
jl     13ae <main+0x1fe>
mov    -0x2c(%rbp),%edi
call   1080 <close@plt>
cmpq   $0x0,-0x48(%rbp)
je     13c2 <main+0x212>
mov    -0x48(%rbp),%rdi
call   1030 <free@plt>
cmpq   $0x0,-0x50(%rbp)
je     13d6 <main+0x226>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
cmpq   $0x0,-0x58(%rbp)
je     13ea <main+0x23a>
mov    -0x58(%rbp),%rdi
call   1030 <free@plt>
mov    -0x5c(%rbp),%eax
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %rsi,%rbx
cmp    $0x2,%edi
jg     11cd <main+0x1d>
xor    %eax,%eax
call   10a0 <usage@plt>
mov    0x8(%rbx),%rdi
mov    0x10(%rbx),%rbp
mov    0x18(%rbx),%r12
lea    0x10(%rsp),%rsi
call   10c0 <file_read@plt>
test   %rax,%rax
je     121a <main+0x6a>
mov    %rax,%rbx
mov    0x10(%rsp),%esi
mov    %rax,%rdi
call   1080 <test_firmware_tcc@plt>
test   %rax,%rax
je     1230 <main+0x80>
lea    0xe53(%rip),%rdi
call   1040 <puts@plt>
mov    $0x2,%ebp
mov    %rbx,%r14
mov    %r14,%rdi
call   1030 <free@plt>
jmp    121f <main+0x6f>
mov    $0x1,%ebp
mov    %ebp,%eax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0x14(%rsp),%rsi
mov    %rbp,%rdi
call   10c0 <file_read@plt>
test   %rax,%rax
je     12e9 <main+0x139>
mov    %rax,%r15
mov    0x10(%rsp),%esi
mov    0x14(%rsp),%ecx
lea    0xc(%rsp),%r8
mov    %rbx,%rdi
mov    %rax,%rdx
call   1050 <patch_firmware_tcc@plt>
mov    %rax,%r14
test   %rax,%rax
je     12f3 <main+0x143>
mov    0x2d54(%rip),%rax
mov    0x2d7d(%rip),%rcx
mov    (%rcx),%esi
or     (%rax),%esi
mov    0x2d6a(%rip),%rax
or     (%rax),%esi
mov    %r12,%rdi
mov    $0x1a4,%edx
call   10b0 <open@plt>
test   %eax,%eax
js     1322 <main+0x172>
mov    %eax,%r13d
mov    0xc(%rsp),%edx
mov    %eax,%edi
mov    %r14,%rsi
call   1060 <write@plt>
xor    %ebp,%ebp
cmp    0xc(%rsp),%eax
je     12cc <main+0x11c>
lea    0xd43(%rip),%rdi
mov    %r12,%rsi
xor    %eax,%eax
call   1070 <printf@plt>
mov    $0x7,%ebp
mov    %r13d,%edi
call   1090 <close@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
mov    %r15,%rdi
call   1030 <free@plt>
jmp    1210 <main+0x60>
mov    $0x3,%ebp
jmp    120d <main+0x5d>
lea    0xd2c(%rip),%rdi
call   1040 <puts@plt>
mov    $0x5,%ebp
mov    %rbx,%rdi
call   1030 <free@plt>
mov    %r15,%rdi
call   1030 <free@plt>
test   %r14,%r14
jne    1210 <main+0x60>
jmp    121f <main+0x6f>
mov    %r12,%rdi
call   10d0 <perror@plt>
mov    $0x6,%ebp
jmp    1304 <main+0x154>

LLVM IR (-O0):
@.str = [38 x i8] c"[ERR] Unknown OF file used, aborting\0A\00"
@.str.1 = [43 x i8] c"[ERR] Could not allocate memory, aborting\0A\00"
@.str.2 = [49 x i8] c"[ERR] Error creating patched firmware, aborting\0A\00"
@O_WRONLY = global i32 0
@O_CREAT = global i32 0
@O_TRUNC = global i32 0
@.str.3 = [38 x i8] c"[ERR] Could not write output file %s\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i32
%10 = alloca i32
%11 = alloca i32
%12 = alloca i32
%13 = alloca i32
%14 = alloca i8*
%15 = alloca i8*
%16 = alloca i8*
%17 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 -1, i32* %9
store i8* null, i8** %15
store i8* null, i8** %16
store i32 0, i32* %17
%18 = load i32, i32* %4
%19 = icmp slt i32 %18, 3
br i1 %19, label %20, label %22
20: ; preds = %2
%21 = call i32 (...) @usage()
br label %22
22: ; preds = %20, %2
%23 = load i8**, i8*** %5
%24 = getelementptr inbounds i8*, i8** %23, i64 1
%25 = load i8*, i8** %24
store i8* %25, i8** %6
%26 = load i8**, i8*** %5
%27 = getelementptr inbounds i8*, i8** %26, i64 2
%28 = load i8*, i8** %27
store i8* %28, i8** %7
%29 = load i8**, i8*** %5
%30 = getelementptr inbounds i8*, i8** %29, i64 3
%31 = load i8*, i8** %30
store i8* %31, i8** %8
%32 = load i8*, i8** %6
%33 = call i8* @file_read(i8* %32, i32* %11)
store i8* %33, i8** %14
%34 = load i8*, i8** %14
%35 = icmp ne i8* %34, null
br i1 %35, label %37, label %36
36: ; preds = %22
store i32 1, i32* %17
br label %95
37: ; preds = %22
%38 = load i8*, i8** %14
%39 = load i32, i32* %11
%40 = call i64 @test_firmware_tcc(i8* %38, i32 %39)
%41 = icmp ne i64 %40, 0
br i1 %41, label %42, label %44
42: ; preds = %37
%43 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str, i64 0, i64 0))
store i32 2, i32* %17
br label %95
44: ; preds = %37
%45 = load i8*, i8** %7
%46 = call i8* @file_read(i8* %45, i32* %12)
store i8* %46, i8** %15
%47 = load i8*, i8** %15
%48 = icmp ne i8* %47, null
br i1 %48, label %50, label %49
49: ; preds = %44
store i32 3, i32* %17
br label %95
50: ; preds = %44
%51 = load i32, i32* %11
%52 = load i32, i32* %12
%53 = add nsw i32 %51, %52
%54 = call i8* @malloc(i32 %53)
store i8* %54, i8** %16
%55 = load i8*, i8** %16
%56 = icmp eq i8* %55, null
br i1 %56, label %57, label %59
57: ; preds = %50
%58 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([43 x i8], [43 x i8]* @.str.1, i64 0, i64 0))
store i32 4, i32* %17
br label %95
59: ; preds = %50
%60 = load i8*, i8** %14
%61 = load i32, i32* %11
%62 = load i8*, i8** %15
%63 = load i32, i32* %12
%64 = call i8* @patch_firmware_tcc(i8* %60, i32 %61, i8* %62, i32 %63, i32* %13)
store i8* %64, i8** %16
%65 = load i8*, i8** %16
%66 = icmp ne i8* %65, null
br i1 %66, label %69, label %67
67: ; preds = %59
%68 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([49 x i8], [49 x i8]* @.str.2, i64 0, i64 0))
store i32 5, i32* %17
br label %95
69: ; preds = %59
%70 = load i8*, i8** %8
%71 = load i32, i32* @O_WRONLY
%72 = load i32, i32* @O_CREAT
%73 = or i32 %71, %72
%74 = load i32, i32* @O_TRUNC
%75 = or i32 %73, %74
%76 = or i32 %75, 0
%77 = call i32 @open(i8* %70, i32 %76, i32 420)
store i32 %77, i32* %9
%78 = load i32, i32* %9
%79 = icmp slt i32 %78, 0
br i1 %79, label %80, label %83
80: ; preds = %69
%81 = load i8*, i8** %8
%82 = call i32 @perror(i8* %81)
store i32 6, i32* %17
br label %95
83: ; preds = %69
%84 = load i32, i32* %9
%85 = load i8*, i8** %16
%86 = load i32, i32* %13
%87 = call i32 @write(i32 %84, i8* %85, i32 %86)
store i32 %87, i32* %10
%88 = load i32, i32* %10
%89 = load i32, i32* %13
%90 = icmp ne i32 %88, %89
br i1 %90, label %91, label %94
91: ; preds = %83
%92 = load i8*, i8** %8
%93 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.3, i64 0, i64 0), i8* %92)
store i32 7, i32* %17
br label %95
94: ; preds = %83
br label %95
95: ; preds = %94, %91, %80, %67, %57, %49, %42, %36
%96 = load i32, i32* %9
%97 = icmp sge i32 %96, 0
br i1 %97, label %98, label %101
98: ; preds = %95
%99 = load i32, i32* %9
%100 = call i32 @close(i32 %99)
br label %101
101: ; preds = %98, %95
%102 = load i8*, i8** %14
%103 = icmp ne i8* %102, null
br i1 %103, label %104, label %107
104: ; preds = %101
%105 = load i8*, i8** %14
%106 = call i32 @free(i8* %105)
br label %107
107: ; preds = %104, %101
%108 = load i8*, i8** %15
%109 = icmp ne i8* %108, null
br i1 %109, label %110, label %113
110: ; preds = %107
%111 = load i8*, i8** %15
%112 = call i32 @free(i8* %111)
br label %113
113: ; preds = %110, %107
%114 = load i8*, i8** %16
%115 = icmp ne i8* %114, null
br i1 %115, label %116, label %119
116: ; preds = %113
%117 = load i8*, i8** %16
%118 = call i32 @free(i8* %117)
br label %119
119: ; preds = %116, %113
%120 = load i32, i32* %17
ret i32 %120
}

LLVM IR (-O2):
@O_WRONLY = global i32 0
@O_CREAT = global i32 0
@O_TRUNC = global i32 0
@.str.3 = [38 x i8] c"[ERR] Could not write output file %s\0A\00"
@str = [48 x i8] c"[ERR] Error creating patched firmware, aborting\00"
@str.5 = [37 x i8] c"[ERR] Unknown OF file used, aborting\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i32
%6 = bitcast i32* %3 to i8*
%7 = bitcast i32* %4 to i8*
%8 = bitcast i32* %5 to i8*
%9 = icmp slt i32 %0, 3
br i1 %9, label %10, label %12
10: ; preds = %2
%11 = tail call i32 (...) @usage()
br label %12
12: ; preds = %10, %2
%13 = getelementptr inbounds i8*, i8** %1, i64 1
%14 = load i8*, i8** %13
%15 = getelementptr inbounds i8*, i8** %1, i64 2
%16 = load i8*, i8** %15
%17 = getelementptr inbounds i8*, i8** %1, i64 3
%18 = load i8*, i8** %17
%19 = call i8* @file_read(i8* %14, i32* %3)
%20 = icmp eq i8* %19, null
br i1 %20, label %67, label %21
21: ; preds = %12
%22 = load i32, i32* %3
%23 = call i64 @test_firmware_tcc(i8* %19, i32 %22)
%24 = icmp eq i64 %23, 0
br i1 %24, label %27, label %25
25: ; preds = %21
%26 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([37 x i8], [37 x i8]* @str.5, i64 0, i64 0))
br label %63
27: ; preds = %21
%28 = call i8* @file_read(i8* %16, i32* %4)
%29 = icmp eq i8* %28, null
br i1 %29, label %63, label %30
30: ; preds = %27
%31 = load i32, i32* %3
%32 = load i32, i32* %4
%33 = call i8* @patch_firmware_tcc(i8* %19, i32 %31, i8* %28, i32 %32, i32* %5)
%34 = icmp eq i8* %33, null
br i1 %34, label %35, label %37
35: ; preds = %30
%36 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([48 x i8], [48 x i8]* @str, i64 0, i64 0))
br label %59
37: ; preds = %30
%38 = load i32, i32* @O_WRONLY
%39 = load i32, i32* @O_CREAT
%40 = or i32 %39, %38
%41 = load i32, i32* @O_TRUNC
%42 = or i32 %40, %41
%43 = call i32 @open(i8* %18, i32 %42, i32 420)
%44 = icmp slt i32 %43, 0
br i1 %44, label %45, label %47
45: ; preds = %37
%46 = call i32 @perror(i8* %18)
br label %59
47: ; preds = %37
%48 = load i32, i32* %5
%49 = call i32 @write(i32 %43, i8* %33, i32 %48)
%50 = load i32, i32* %5
%51 = icmp eq i32 %49, %50
br i1 %51, label %54, label %52
52: ; preds = %47
%53 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([38 x i8], [38 x i8]* @.str.3, i64 0, i64 0), i8* %18)
br label %54
54: ; preds = %47, %52
%55 = phi i32 [ 7, %52 ], [ 0, %47 ]
%56 = call i32 @close(i32 %43)
%57 = call i32 @free(i8* %19)
%58 = call i32 @free(i8* %28)
br label %63
59: ; preds = %35, %45
%60 = phi i32 [ 6, %45 ], [ 5, %35 ]
%61 = call i32 @free(i8* %19)
%62 = call i32 @free(i8* %28)
br i1 %34, label %67, label %63
63: ; preds = %59, %54, %27, %25
%64 = phi i8* [ %19, %25 ], [ %19, %27 ], [ %33, %54 ], [ %33, %59 ]
%65 = phi i32 [ 2, %25 ], [ 3, %27 ], [ %55, %54 ], [ %60, %59 ]
%66 = call i32 @free(i8* %64)
br label %67
67: ; preds = %63, %12, %59
%68 = phi i32 [ %60, %59 ], [ 1, %12 ], [ %65, %63 ]
ret i32 %68
}