#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct stat {
  int /*<<< orphan*/ st_size;
};

/* Variables and functions */
int MAP_FIXED;
int MAP_SHARED;
int /*<<< orphan*/ O_RDWR;
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ fstat(int, struct stat *);
void *mmap(void *, int /*<<< orphan*/, int, int, int, int /*<<< orphan*/);
int open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *);
void *sbrk(int /*<<< orphan*/);
void stub1();
int main() {
  int inj_fd;
  void *start_addr;
  void *brk;
  struct stat st;
  void (*assm_func)() = NULL;
  inj_fd = open("jitasm.bin", O_RDWR);
  fstat(inj_fd, &st);
  brk = sbrk(st.st_size);
  start_addr = mmap(brk, st.st_size, PROT_READ | PROT_WRITE | PROT_EXEC,
                    MAP_SHARED | MAP_FIXED, inj_fd, 0);
  close(inj_fd);
  assm_func = (void (*)(void))start_addr;
  printf("***before code injection***\n");
  (*assm_func)();
  printf("***after code injection***\n");
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x0,-0x28(%rbp)
mov    0x2e5a(%rip),%rax
mov    (%rax),%esi
lea    0xe79(%rip),%rdi
call   1070 <open@plt>
mov    %eax,-0x8(%rbp)
mov    -0x8(%rbp),%edi
lea    -0x20(%rbp),%rsi
call   1080 <fstat@plt>
mov    -0x20(%rbp),%edi
call   1060 <sbrk@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rdi
mov    -0x20(%rbp),%esi
mov    0x2e43(%rip),%rax
mov    (%rax),%edx
mov    0x2e02(%rip),%rax
or     (%rax),%edx
mov    0x2e09(%rip),%rax
or     (%rax),%edx
mov    0x2e18(%rip),%rax
mov    (%rax),%ecx
mov    0x2ddf(%rip),%rax
or     (%rax),%ecx
mov    -0x8(%rbp),%r8d
xor    %r9d,%r9d
call   1030 <mmap@plt>
mov    %rax,-0x10(%rbp)
mov    -0x8(%rbp),%edi
call   1050 <close@plt>
mov    -0x10(%rbp),%rax
mov    %rax,-0x28(%rbp)
lea    0xe09(%rip),%rdi
call   1040 <printf@plt>
mov    $0x0,%al
call   *-0x28(%rbp)
lea    0xe15(%rip),%rdi
call   1040 <printf@plt>
xor    %eax,%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %rbx
push   %rax
mov    0x2e6e(%rip),%rax
mov    (%rax),%esi
lea    0xe8d(%rip),%rdi
call   1070 <open@plt>
mov    %eax,%ebx
mov    %rsp,%rsi
mov    %eax,%edi
call   1080 <fstat@plt>
mov    (%rsp),%ebp
mov    %ebp,%edi
call   1060 <sbrk@plt>
mov    0x2e63(%rip),%rcx
mov    0x2e24(%rip),%rdx
mov    (%rdx),%edx
or     (%rcx),%edx
mov    0x2e29(%rip),%rcx
or     (%rcx),%edx
mov    0x2e38(%rip),%rsi
mov    0x2e01(%rip),%rcx
mov    (%rcx),%ecx
or     (%rsi),%ecx
mov    %rax,%rdi
mov    %ebp,%esi
mov    %ebx,%r8d
xor    %r9d,%r9d
call   1040 <mmap@plt>
mov    %rax,%rbp
mov    %ebx,%edi
call   1050 <close@plt>
lea    0xe2f(%rip),%rdi
call   1030 <puts@plt>
xor    %eax,%eax
call   *%rbp
lea    0xe3b(%rip),%rdi
call   1030 <puts@plt>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %rbp
ret

LLVM IR (-O0):
%struct.stat = type { i32 }
@.str = [11 x i8] c"jitasm.bin\00"
@O_RDWR = global i32 0
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@MAP_SHARED = global i32 0
@MAP_FIXED = global i32 0
@.str.1 = [29 x i8] c"***before code injection***\0A\00"
@.str.2 = [28 x i8] c"***after code injection***\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca %struct.stat
%6 = alloca void (...)*
store i32 0, i32* %1
store void (...)* null, void (...)** %6
%7 = load i32, i32* @O_RDWR
%8 = call i32 @open(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0), i32 %7)
store i32 %8, i32* %2
%9 = load i32, i32* %2
%10 = call i32 @fstat(i32 %9, %struct.stat* %5)
%11 = getelementptr inbounds %struct.stat, %struct.stat* %5, i32 0, i32 0
%12 = load i32, i32* %11
%13 = call i8* @sbrk(i32 %12)
store i8* %13, i8** %4
%14 = load i8*, i8** %4
%15 = getelementptr inbounds %struct.stat, %struct.stat* %5, i32 0, i32 0
%16 = load i32, i32* %15
%17 = load i32, i32* @PROT_READ
%18 = load i32, i32* @PROT_WRITE
%19 = or i32 %17, %18
%20 = load i32, i32* @PROT_EXEC
%21 = or i32 %19, %20
%22 = load i32, i32* @MAP_SHARED
%23 = load i32, i32* @MAP_FIXED
%24 = or i32 %22, %23
%25 = load i32, i32* %2
%26 = call i8* @mmap(i8* %14, i32 %16, i32 %21, i32 %24, i32 %25, i32 0)
store i8* %26, i8** %3
%27 = load i32, i32* %2
%28 = call i32 @close(i32 %27)
%29 = load i8*, i8** %3
%30 = bitcast i8* %29 to void ()*
%31 = bitcast void ()* %30 to void (...)*
store void (...)* %31, void (...)** %6
%32 = call i32 @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.1, i64 0, i64 0))
%33 = load void (...)*, void (...)** %6
%34 = call i32 @printf(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.2, i64 0, i64 0))
ret i32 0
}

LLVM IR (-O2):
%struct.stat = type { i32 }
@.str = [11 x i8] c"jitasm.bin\00"
@O_RDWR = global i32 0
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@MAP_SHARED = global i32 0
@MAP_FIXED = global i32 0
@str = [28 x i8] c"***before code injection***\00"
@str.3 = [27 x i8] c"***after code injection***\00"
define i32 @main() {
%1 = alloca %struct.stat
%2 = bitcast %struct.stat* %1 to i8*
%3 = load i32, i32* @O_RDWR
%4 = tail call i32 @open(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0), i32 %3)
%5 = call i32 @fstat(i32 %4, %struct.stat* %1)
%6 = getelementptr inbounds %struct.stat, %struct.stat* %1, i64 0, i32 0
%7 = load i32, i32* %6
%8 = tail call i8* @sbrk(i32 %7)
%9 = load i32, i32* @PROT_READ
%10 = load i32, i32* @PROT_WRITE
%11 = or i32 %10, %9
%12 = load i32, i32* @PROT_EXEC
%13 = or i32 %11, %12
%14 = load i32, i32* @MAP_SHARED
%15 = load i32, i32* @MAP_FIXED
%16 = or i32 %15, %14
%17 = tail call i8* @mmap(i8* %8, i32 %7, i32 %13, i32 %16, i32 %4, i32 0)
%18 = tail call i32 @close(i32 %4)
%19 = bitcast i8* %17 to void (...)*
%20 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([28 x i8], [28 x i8]* @str, i64 0, i64 0))
tail call void (...) %19()
%21 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([27 x i8], [27 x i8]* @str.3, i64 0, i64 0))
ret i32 0
}