#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ pthread_t;

/* Variables and functions */
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
int RTLD_GLOBAL;
int RTLD_LAZY;
int RTLD_LOCAL;
int RTLD_NODELETE;
int RTLD_NOW;
int /*<<< orphan*/ cacheflush(unsigned int *, int);
int /*<<< orphan*/ debug(char *, ...);
int /*<<< orphan*/ dlclose(unsigned int *);
char *dlerror();
unsigned int *dlopen(char *, int);
void *dlsym(unsigned int *, char *);
char *malloc(int);
int /*<<< orphan*/ mprotect(void *, int, int);
int /*<<< orphan*/ pthread_create(int /*<<< orphan*/ *, int /*<<< orphan*/ *,
                                  void *, void *);
int /*<<< orphan*/ sprintf(char *, char *, char const *);
int /*<<< orphan*/ strcpy(char *, char const *);
int strlen(char const *);
void injector(const char *path) {
  char s[256];
  debug("injector() started");
  unsigned *handle = NULL;
  debug("- getting self handle");
  if ((handle = dlopen(NULL, RTLD_LAZY | RTLD_GLOBAL)) == NULL) {
    debug(dlerror());
    return;
  }
  debug("- self handle retrieved");
  debug("- getting keypress function");
  unsigned *KeyCommon_SendKeyPressInput =
      dlsym(handle, "_ZN9KeyCommon17SendKeyPressInputEii");
  if (KeyCommon_SendKeyPressInput == NULL) {
    debug(dlerror());
    return;
  }
  debug("- keypress function retrieved");
  dlclose(handle);
  sprintf(s, "%sambi.so", path);
  debug("- loading library:");
  debug(s);
  if ((handle = dlopen(s, RTLD_NOW | RTLD_LOCAL | RTLD_NODELETE)) == NULL) {
    debug(dlerror());
    return;
  }
  debug("- library loaded");
  debug("- obtain injection procedure address");
  unsigned *ex_injection = dlsym(handle, "injection");
  if (ex_injection == NULL) {
    debug(dlerror());
    dlclose(handle);
    return;
  }
  debug("- injection function retrieved");
  debug("- obtain ambi function address");
  void (*ex_ambi_routine)(void *);
  *(void **)(&ex_ambi_routine) = dlsym(handle, "ambi_routine");
  if (ex_ambi_routine == NULL) {
    debug(dlerror());
    dlclose(handle);
    return;
  }
  debug("- ambi function retrieved");
  dlclose(handle);
  debug("- injecting...");
  int page = ((unsigned)KeyCommon_SendKeyPressInput) & ~0x0FFF;
  mprotect((void *)page, 8192, PROT_READ | PROT_WRITE | PROT_EXEC);
  if (KeyCommon_SendKeyPressInput[4] == 0xE51FF004) {
    debug("- old injection detected");
    int page2 = ((unsigned)ex_injection) & ~0x0FFF;
    mprotect((void *)page2, 8192, PROT_READ | PROT_WRITE | PROT_EXEC);
    ex_injection[9] = KeyCommon_SendKeyPressInput[4];
    ex_injection[10] = KeyCommon_SendKeyPressInput[5];
    mprotect((void *)page2, 8192, PROT_READ | PROT_EXEC);
    cacheflush(ex_injection + 9, 8);
  }
  KeyCommon_SendKeyPressInput[4] = 0xE51FF004;
  KeyCommon_SendKeyPressInput[5] = (unsigned)ex_injection;
  mprotect((void *)page, 8192, PROT_READ | PROT_EXEC);
  pthread_t helper;
  char *path_heap = malloc(sizeof(char) * (1 + strlen(path)));
  strcpy(path_heap, path);
  pthread_create(&helper, NULL, (void *)ex_ambi_routine, (void *)path_heap);
  debug("ambi routine started in separate thread:%d", helper);
  cacheflush(KeyCommon_SendKeyPressInput + 4, 8);
  debug("injector() exiting");
}


x86 assembly (clang, -O0):
<injector>:
push   %rbp
mov    %rsp,%rbp
sub    $0x150,%rsp
mov    %rdi,-0x8(%rbp)
lea    0xe2a(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
movq   $0x0,-0x118(%rbp)
lea    0xe24(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
mov    0x2db3(%rip),%rax
mov    (%rax),%esi
mov    0x2dda(%rip),%rax
or     (%rax),%esi
xor    %eax,%eax
mov    %eax,%edi
call   1080 <dlopen@plt>
mov    %rax,-0x118(%rbp)
cmp    $0x0,%rax
jne    1238 <injector+0x78>
mov    $0x0,%al
call   1030 <dlerror@plt>
mov    %rax,%rdi
mov    $0x0,%al
call   1060 <debug@plt>
jmp    15e8 <injector+0x428>
lea    0xdea(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
lea    0xdf4(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
mov    -0x118(%rbp),%rdi
lea    0xdfb(%rip),%rsi
call   10c0 <dlsym@plt>
mov    %rax,-0x120(%rbp)
cmpq   $0x0,-0x120(%rbp)
jne    1292 <injector+0xd2>
mov    $0x0,%al
call   1030 <dlerror@plt>
mov    %rax,%rdi
mov    $0x0,%al
call   1060 <debug@plt>
jmp    15e8 <injector+0x428>
lea    0xde8(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
mov    -0x118(%rbp),%rdi
call   10e0 <dlclose@plt>
lea    -0x110(%rbp),%rdi
mov    -0x8(%rbp),%rdx
lea    0xde1(%rip),%rsi
call   10d0 <sprintf@plt>
lea    0xddf(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
lea    -0x110(%rbp),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
lea    -0x110(%rbp),%rdi
mov    0x2ceb(%rip),%rax
mov    (%rax),%esi
mov    0x2caa(%rip),%rax
or     (%rax),%esi
mov    0x2cd1(%rip),%rax
or     (%rax),%esi
call   1080 <dlopen@plt>
mov    %rax,-0x118(%rbp)
cmp    $0x0,%rax
jne    132d <injector+0x16d>
mov    $0x0,%al
call   1030 <dlerror@plt>
mov    %rax,%rdi
mov    $0x0,%al
call   1060 <debug@plt>
jmp    15e8 <injector+0x428>
lea    0xd88(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
lea    0xd8b(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
mov    -0x118(%rbp),%rdi
lea    0xd9b(%rip),%rsi
call   10c0 <dlsym@plt>
mov    %rax,-0x128(%rbp)
cmpq   $0x0,-0x128(%rbp)
jne    1393 <injector+0x1d3>
mov    $0x0,%al
call   1030 <dlerror@plt>
mov    %rax,%rdi
mov    $0x0,%al
call   1060 <debug@plt>
mov    -0x118(%rbp),%rdi
call   10e0 <dlclose@plt>
jmp    15e8 <injector+0x428>
lea    0xd62(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
lea    0xd73(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
mov    -0x118(%rbp),%rdi
lea    0xd7d(%rip),%rsi
call   10c0 <dlsym@plt>
mov    %rax,-0x130(%rbp)
cmpq   $0x0,-0x130(%rbp)
jne    13f9 <injector+0x239>
mov    $0x0,%al
call   1030 <dlerror@plt>
mov    %rax,%rdi
mov    $0x0,%al
call   1060 <debug@plt>
mov    -0x118(%rbp),%rdi
call   10e0 <dlclose@plt>
jmp    15e8 <injector+0x428>
lea    0xd47(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
mov    -0x118(%rbp),%rdi
call   10e0 <dlclose@plt>
lea    0xd47(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
mov    -0x120(%rbp),%rax
and    $0xfffff000,%eax
mov    %eax,-0x134(%rbp)
movslq -0x134(%rbp),%rdi
mov    0x2bb7(%rip),%rax
mov    (%rax),%edx
mov    0x2b6e(%rip),%rax
or     (%rax),%edx
mov    0x2b75(%rip),%rax
or     (%rax),%edx
mov    $0x2000,%esi
call   10b0 <mprotect@plt>
mov    -0x120(%rbp),%rax
cmpl   $0xe51ff004,0x10(%rax)
jne    151f <injector+0x35f>
lea    0xcf6(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
mov    -0x128(%rbp),%rax
and    $0xfffff000,%eax
mov    %eax,-0x138(%rbp)
movslq -0x138(%rbp),%rdi
mov    0x2b57(%rip),%rax
mov    (%rax),%edx
mov    0x2b0e(%rip),%rax
or     (%rax),%edx
mov    0x2b15(%rip),%rax
or     (%rax),%edx
mov    $0x2000,%esi
call   10b0 <mprotect@plt>
mov    -0x120(%rbp),%rax
mov    0x10(%rax),%ecx
mov    -0x128(%rbp),%rax
mov    %ecx,0x24(%rax)
mov    -0x120(%rbp),%rax
mov    0x14(%rax),%ecx
mov    -0x128(%rbp),%rax
mov    %ecx,0x28(%rax)
movslq -0x138(%rbp),%rdi
mov    0x2b03(%rip),%rax
mov    (%rax),%edx
mov    0x2aca(%rip),%rax
or     (%rax),%edx
mov    $0x2000,%esi
call   10b0 <mprotect@plt>
mov    -0x128(%rbp),%rdi
add    $0x24,%rdi
mov    $0x8,%esi
call   1070 <cacheflush@plt>
mov    -0x120(%rbp),%rax
movl   $0xe51ff004,0x10(%rax)
mov    -0x128(%rbp),%rax
mov    %eax,%ecx
mov    -0x120(%rbp),%rax
mov    %ecx,0x14(%rax)
movslq -0x134(%rbp),%rdi
mov    0x2aaa(%rip),%rax
mov    (%rax),%edx
mov    0x2a71(%rip),%rax
or     (%rax),%edx
mov    $0x2000,%esi
call   10b0 <mprotect@plt>
mov    -0x8(%rbp),%rdi
call   1050 <strlen@plt>
add    $0x1,%eax
cltq
shl    $0x0,%rax
mov    %eax,%edi
call   1090 <malloc@plt>
mov    %rax,-0x148(%rbp)
mov    -0x148(%rbp),%rdi
mov    -0x8(%rbp),%rsi
call   1040 <strcpy@plt>
mov    -0x130(%rbp),%rdx
mov    -0x148(%rbp),%rcx
lea    -0x13c(%rbp),%rdi
xor    %eax,%eax
mov    %eax,%esi
call   10a0 <pthread_create@plt>
mov    -0x13c(%rbp),%esi
lea    0xbcb(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
mov    -0x120(%rbp),%rdi
add    $0x10,%rdi
mov    $0x8,%esi
call   1070 <cacheflush@plt>
lea    0xbd3(%rip),%rdi
mov    $0x0,%al
call   1060 <debug@plt>
add    $0x150,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<injector>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x128,%rsp
mov    %rdi,%r14
lea    0xe25(%rip),%rdi
xor    %eax,%eax
call   1060 <debug@plt>
lea    0xe2a(%rip),%rdi
xor    %eax,%eax
call   1060 <debug@plt>
mov    0x2db9(%rip),%rax
mov    0x2de2(%rip),%rcx
mov    (%rcx),%esi
or     (%rax),%esi
xor    %edi,%edi
call   1080 <dlopen@plt>
test   %rax,%rax
je     14ab <injector+0x2eb>
mov    %rax,%rbx
lea    0xe0d(%rip),%rdi
xor    %eax,%eax
call   1060 <debug@plt>
lea    0xe17(%rip),%rdi
xor    %eax,%eax
call   1060 <debug@plt>
lea    0xe25(%rip),%rsi
mov    %rbx,%rdi
call   10c0 <dlsym@plt>
test   %rax,%rax
je     14ab <injector+0x2eb>
mov    %rax,%rbp
lea    0xe2e(%rip),%rdi
xor    %eax,%eax
call   1060 <debug@plt>
mov    %rbx,%rdi
call   10e0 <dlclose@plt>
lea    0xe36(%rip),%rsi
lea    0x20(%rsp),%rbx
mov    %rbx,%rdi
mov    %r14,%rdx
call   10d0 <sprintf@plt>
lea    0xe29(%rip),%rdi
xor    %eax,%eax
call   1060 <debug@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1060 <debug@plt>
mov    0x2d40(%rip),%rax
mov    0x2d01(%rip),%rcx
mov    (%rcx),%esi
or     (%rax),%esi
mov    0x2d26(%rip),%rax
or     (%rax),%esi
mov    %rbx,%rdi
call   1080 <dlopen@plt>
test   %rax,%rax
je     14cd <injector+0x30d>
mov    %rax,%rbx
lea    0xdf5(%rip),%rdi
xor    %eax,%eax
call   1060 <debug@plt>
lea    0xdf8(%rip),%rdi
xor    %eax,%eax
call   1060 <debug@plt>
lea    0xe0f(%rip),%rsi
mov    %rbx,%rdi
call   10c0 <dlsym@plt>
test   %rax,%rax
je     14e0 <injector+0x320>
mov    %rax,%r12
lea    0xdfe(%rip),%rdi
xor    %eax,%eax
call   1060 <debug@plt>
lea    0xe0f(%rip),%rdi
xor    %eax,%eax
call   1060 <debug@plt>
lea    0xe20(%rip),%rsi
mov    %rbx,%rdi
call   10c0 <dlsym@plt>
test   %rax,%rax
je     14e0 <injector+0x320>
mov    %rax,%r15
lea    0xe12(%rip),%rdi
xor    %eax,%eax
call   1060 <debug@plt>
mov    %rbx,%rdi
call   10e0 <dlclose@plt>
lea    0xe16(%rip),%rdi
xor    %eax,%eax
call   1060 <debug@plt>
movslq %ebp,%rbx
mov    0x2c9c(%rip),%rax
mov    0x2c55(%rip),%r13
mov    0x0(%r13),%edx
or     (%rax),%edx
and    $0xfffffffffffff000,%rbx
mov    0x2c51(%rip),%rax
or     (%rax),%edx
mov    %rbx,%rdi
mov    $0x2000,%esi
call   10b0 <mprotect@plt>
mov    %rbp,%rax
add    $0x10,%rax
mov    %rax,0x18(%rsp)
cmpl   $0xe51ff004,0x10(%rbp)
jne    1427 <injector+0x267>
lea    0xdca(%rip),%rdi
xor    %eax,%eax
call   1060 <debug@plt>
mov    %r15,0x10(%rsp)
movslq %r12d,%r15
and    $0xfffffffffffff000,%r15
mov    0x0(%r13),%edx
mov    0x2c31(%rip),%rax
or     (%rax),%edx
mov    0x2bf8(%rip),%rax
or     (%rax),%edx
mov    %r15,%rdi
mov    $0x2000,%esi
call   10b0 <mprotect@plt>
mov    0x10(%rbp),%eax
mov    %r12,%r13
add    $0x24,%r13
mov    %eax,0x24(%r12)
mov    0x14(%rbp),%eax
mov    %eax,0x28(%r12)
mov    0x2bcb(%rip),%rax
mov    (%rax),%edx
mov    0x2bf2(%rip),%rax
or     (%rax),%edx
mov    %r15,%rdi
mov    0x10(%rsp),%r15
mov    $0x2000,%esi
call   10b0 <mprotect@plt>
mov    %r13,%rdi
mov    $0x8,%esi
call   1070 <cacheflush@plt>
movl   $0xe51ff004,0x10(%rbp)
mov    %r12d,0x14(%rbp)
mov    0x2b8f(%rip),%rax
mov    (%rax),%edx
mov    0x2bb6(%rip),%rax
or     (%rax),%edx
mov    %rbx,%rdi
mov    $0x2000,%esi
call   10b0 <mprotect@plt>
mov    %r14,%rdi
call   1050 <strlen@plt>
lea    0x1(%rax),%edi
call   1090 <malloc@plt>
mov    %rax,%rbx
mov    %rax,%rdi
mov    %r14,%rsi
call   1040 <strcpy@plt>
lea    0xc(%rsp),%rdi
xor    %esi,%esi
mov    %r15,%rdx
mov    %rbx,%rcx
call   10a0 <pthread_create@plt>
mov    0xc(%rsp),%esi
lea    0xcfd(%rip),%rdi
xor    %eax,%eax
call   1060 <debug@plt>
mov    0x18(%rsp),%rdi
mov    $0x8,%esi
call   1070 <cacheflush@plt>
lea    0xd0b(%rip),%rdi
jmp    14d7 <injector+0x317>
xor    %eax,%eax
call   1030 <dlerror@plt>
mov    %rax,%rdi
xor    %eax,%eax
add    $0x128,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
jmp    1060 <debug@plt>
xor    %eax,%eax
call   1030 <dlerror@plt>
mov    %rax,%rdi
xor    %eax,%eax
call   1060 <debug@plt>
jmp    14f9 <injector+0x339>
xor    %eax,%eax
call   1030 <dlerror@plt>
mov    %rax,%rdi
xor    %eax,%eax
call   1060 <debug@plt>
mov    %rbx,%rdi
call   10e0 <dlclose@plt>
add    $0x128,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [19 x i8] c"injector() started\00"
@.str.1 = [22 x i8] c"- getting self handle\00"
@RTLD_LAZY = global i32 0
@RTLD_GLOBAL = global i32 0
@.str.2 = [24 x i8] c"- self handle retrieved\00"
@.str.3 = [28 x i8] c"- getting keypress function\00"
@.str.4 = [36 x i8] c"_ZN9KeyCommon17SendKeyPressInputEii\00"
@.str.5 = [30 x i8] c"- keypress function retrieved\00"
@.str.6 = [10 x i8] c"%sambi.so\00"
@.str.7 = [19 x i8] c"- loading library:\00"
@RTLD_NOW = global i32 0
@RTLD_LOCAL = global i32 0
@RTLD_NODELETE = global i32 0
@.str.8 = [17 x i8] c"- library loaded\00"
@.str.9 = [37 x i8] c"- obtain injection procedure address\00"
@.str.10 = [10 x i8] c"injection\00"
@.str.11 = [31 x i8] c"- injection function retrieved\00"
@.str.12 = [31 x i8] c"- obtain ambi function address\00"
@.str.13 = [13 x i8] c"ambi_routine\00"
@.str.14 = [26 x i8] c"- ambi function retrieved\00"
@.str.15 = [15 x i8] c"- injecting...\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@.str.16 = [25 x i8] c"- old injection detected\00"
@.str.17 = [43 x i8] c"ambi routine started in separate thread:%d\00"
@.str.18 = [19 x i8] c"injector() exiting\00"
define void @injector(i8* %0) {
%2 = alloca i8*
%3 = alloca [256 x i8]
%4 = alloca i32*
%5 = alloca i32*
%6 = alloca i32*
%7 = alloca void (i8*)*
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i8*
store i8* %0, i8** %2
%12 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i64 0, i64 0))
store i32* null, i32** %4
%13 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.1, i64 0, i64 0))
%14 = load i32, i32* @RTLD_LAZY
%15 = load i32, i32* @RTLD_GLOBAL
%16 = or i32 %14, %15
%17 = call i32* @dlopen(i8* null, i32 %16)
store i32* %17, i32** %4
%18 = icmp eq i32* %17, null
br i1 %18, label %19, label %22
19: ; preds = %1
%20 = call i8* (...) @dlerror()
%21 = call i32 (i8*, ...) @debug(i8* %20)
br label %169
22: ; preds = %1
%23 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.2, i64 0, i64 0))
%24 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.3, i64 0, i64 0))
%25 = load i32*, i32** %4
%26 = call i8* @dlsym(i32* %25, i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.4, i64 0, i64 0))
%27 = bitcast i8* %26 to i32*
store i32* %27, i32** %5
%28 = load i32*, i32** %5
%29 = icmp eq i32* %28, null
br i1 %29, label %30, label %33
30: ; preds = %22
%31 = call i8* (...) @dlerror()
%32 = call i32 (i8*, ...) @debug(i8* %31)
br label %169
33: ; preds = %22
%34 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.5, i64 0, i64 0))
%35 = load i32*, i32** %4
%36 = call i32 @dlclose(i32* %35)
%37 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%38 = load i8*, i8** %2
%39 = call i32 @sprintf(i8* %37, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.6, i64 0, i64 0), i8* %38)
%40 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.7, i64 0, i64 0))
%41 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%42 = call i32 (i8*, ...) @debug(i8* %41)
%43 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%44 = load i32, i32* @RTLD_NOW
%45 = load i32, i32* @RTLD_LOCAL
%46 = or i32 %44, %45
%47 = load i32, i32* @RTLD_NODELETE
%48 = or i32 %46, %47
%49 = call i32* @dlopen(i8* %43, i32 %48)
store i32* %49, i32** %4
%50 = icmp eq i32* %49, null
br i1 %50, label %51, label %54
51: ; preds = %33
%52 = call i8* (...) @dlerror()
%53 = call i32 (i8*, ...) @debug(i8* %52)
br label %169
54: ; preds = %33
%55 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.8, i64 0, i64 0))
%56 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.9, i64 0, i64 0))
%57 = load i32*, i32** %4
%58 = call i8* @dlsym(i32* %57, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.10, i64 0, i64 0))
%59 = bitcast i8* %58 to i32*
store i32* %59, i32** %6
%60 = load i32*, i32** %6
%61 = icmp eq i32* %60, null
br i1 %61, label %62, label %67
62: ; preds = %54
%63 = call i8* (...) @dlerror()
%64 = call i32 (i8*, ...) @debug(i8* %63)
%65 = load i32*, i32** %4
%66 = call i32 @dlclose(i32* %65)
br label %169
67: ; preds = %54
%68 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.11, i64 0, i64 0))
%69 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.12, i64 0, i64 0))
%70 = load i32*, i32** %4
%71 = call i8* @dlsym(i32* %70, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.13, i64 0, i64 0))
%72 = bitcast void (i8*)** %7 to i8**
store i8* %71, i8** %72
%73 = load void (i8*)*, void (i8*)** %7
%74 = icmp eq void (i8*)* %73, null
br i1 %74, label %75, label %80
75: ; preds = %67
%76 = call i8* (...) @dlerror()
%77 = call i32 (i8*, ...) @debug(i8* %76)
%78 = load i32*, i32** %4
%79 = call i32 @dlclose(i32* %78)
br label %169
80: ; preds = %67
%81 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.14, i64 0, i64 0))
%82 = load i32*, i32** %4
%83 = call i32 @dlclose(i32* %82)
%84 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.15, i64 0, i64 0))
%85 = load i32*, i32** %5
%86 = ptrtoint i32* %85 to i32
%87 = and i32 %86, -4096
store i32 %87, i32* %8
%88 = load i32, i32* %8
%89 = sext i32 %88 to i64
%90 = inttoptr i64 %89 to i8*
%91 = load i32, i32* @PROT_READ
%92 = load i32, i32* @PROT_WRITE
%93 = or i32 %91, %92
%94 = load i32, i32* @PROT_EXEC
%95 = or i32 %93, %94
%96 = call i32 @mprotect(i8* %90, i32 8192, i32 %95)
%97 = load i32*, i32** %5
%98 = getelementptr inbounds i32, i32* %97, i64 4
%99 = load i32, i32* %98
%100 = icmp eq i32 %99, -450891772
br i1 %100, label %101, label %135
101: ; preds = %80
%102 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.16, i64 0, i64 0))
%103 = load i32*, i32** %6
%104 = ptrtoint i32* %103 to i32
%105 = and i32 %104, -4096
store i32 %105, i32* %9
%106 = load i32, i32* %9
%107 = sext i32 %106 to i64
%108 = inttoptr i64 %107 to i8*
%109 = load i32, i32* @PROT_READ
%110 = load i32, i32* @PROT_WRITE
%111 = or i32 %109, %110
%112 = load i32, i32* @PROT_EXEC
%113 = or i32 %111, %112
%114 = call i32 @mprotect(i8* %108, i32 8192, i32 %113)
%115 = load i32*, i32** %5
%116 = getelementptr inbounds i32, i32* %115, i64 4
%117 = load i32, i32* %116
%118 = load i32*, i32** %6
%119 = getelementptr inbounds i32, i32* %118, i64 9
store i32 %117, i32* %119
%120 = load i32*, i32** %5
%121 = getelementptr inbounds i32, i32* %120, i64 5
%122 = load i32, i32* %121
%123 = load i32*, i32** %6
%124 = getelementptr inbounds i32, i32* %123, i64 10
store i32 %122, i32* %124
%125 = load i32, i32* %9
%126 = sext i32 %125 to i64
%127 = inttoptr i64 %126 to i8*
%128 = load i32, i32* @PROT_READ
%129 = load i32, i32* @PROT_EXEC
%130 = or i32 %128, %129
%131 = call i32 @mprotect(i8* %127, i32 8192, i32 %130)
%132 = load i32*, i32** %6
%133 = getelementptr inbounds i32, i32* %132, i64 9
%134 = call i32 @cacheflush(i32* %133, i32 8)
br label %135
135: ; preds = %101, %80
%136 = load i32*, i32** %5
%137 = getelementptr inbounds i32, i32* %136, i64 4
store i32 -450891772, i32* %137
%138 = load i32*, i32** %6
%139 = ptrtoint i32* %138 to i32
%140 = load i32*, i32** %5
%141 = getelementptr inbounds i32, i32* %140, i64 5
store i32 %139, i32* %141
%142 = load i32, i32* %8
%143 = sext i32 %142 to i64
%144 = inttoptr i64 %143 to i8*
%145 = load i32, i32* @PROT_READ
%146 = load i32, i32* @PROT_EXEC
%147 = or i32 %145, %146
%148 = call i32 @mprotect(i8* %144, i32 8192, i32 %147)
%149 = load i8*, i8** %2
%150 = call i32 @strlen(i8* %149)
%151 = add nsw i32 1, %150
%152 = sext i32 %151 to i64
%153 = mul i64 1, %152
%154 = trunc i64 %153 to i32
%155 = call i8* @malloc(i32 %154)
store i8* %155, i8** %11
%156 = load i8*, i8** %11
%157 = load i8*, i8** %2
%158 = call i32 @strcpy(i8* %156, i8* %157)
%159 = load void (i8*)*, void (i8*)** %7
%160 = bitcast void (i8*)* %159 to i8*
%161 = load i8*, i8** %11
%162 = call i32 @pthread_create(i32* %10, i32* null, i8* %160, i8* %161)
%163 = load i32, i32* %10
%164 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([43 x i8], [43 x i8]* @.str.17, i64 0, i64 0), i32 %163)
%165 = load i32*, i32** %5
%166 = getelementptr inbounds i32, i32* %165, i64 4
%167 = call i32 @cacheflush(i32* %166, i32 8)
%168 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.18, i64 0, i64 0))
br label %169
169: ; preds = %135, %75, %62, %51, %30, %19
ret void
}

LLVM IR (-O2):
@.str = [19 x i8] c"injector() started\00"
@.str.1 = [22 x i8] c"- getting self handle\00"
@RTLD_LAZY = global i32 0
@RTLD_GLOBAL = global i32 0
@.str.2 = [24 x i8] c"- self handle retrieved\00"
@.str.3 = [28 x i8] c"- getting keypress function\00"
@.str.4 = [36 x i8] c"_ZN9KeyCommon17SendKeyPressInputEii\00"
@.str.5 = [30 x i8] c"- keypress function retrieved\00"
@.str.6 = [10 x i8] c"%sambi.so\00"
@.str.7 = [19 x i8] c"- loading library:\00"
@RTLD_NOW = global i32 0
@RTLD_LOCAL = global i32 0
@RTLD_NODELETE = global i32 0
@.str.8 = [17 x i8] c"- library loaded\00"
@.str.9 = [37 x i8] c"- obtain injection procedure address\00"
@.str.10 = [10 x i8] c"injection\00"
@.str.11 = [31 x i8] c"- injection function retrieved\00"
@.str.12 = [31 x i8] c"- obtain ambi function address\00"
@.str.13 = [13 x i8] c"ambi_routine\00"
@.str.14 = [26 x i8] c"- ambi function retrieved\00"
@.str.15 = [15 x i8] c"- injecting...\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@.str.16 = [25 x i8] c"- old injection detected\00"
@.str.17 = [43 x i8] c"ambi routine started in separate thread:%d\00"
@.str.18 = [19 x i8] c"injector() exiting\00"
define void @injector(i8* %0) {
%2 = alloca [256 x i8]
%3 = alloca i32
%4 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%5 = tail call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i64 0, i64 0))
%6 = tail call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.1, i64 0, i64 0))
%7 = load i32, i32* @RTLD_LAZY
%8 = load i32, i32* @RTLD_GLOBAL
%9 = or i32 %8, %7
%10 = tail call i32* @dlopen(i8* null, i32 %9)
%11 = icmp eq i32* %10, null
br i1 %11, label %12, label %15
12: ; preds = %1
%13 = tail call i8* (...) @dlerror()
%14 = tail call i32 (i8*, ...) @debug(i8* %13)
br label %123
15: ; preds = %1
%16 = tail call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.2, i64 0, i64 0))
%17 = tail call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.3, i64 0, i64 0))
%18 = tail call i8* @dlsym(i32* %10, i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.4, i64 0, i64 0))
%19 = icmp eq i8* %18, null
br i1 %19, label %20, label %23
20: ; preds = %15
%21 = tail call i8* (...) @dlerror()
%22 = tail call i32 (i8*, ...) @debug(i8* %21)
br label %123
23: ; preds = %15
%24 = tail call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.5, i64 0, i64 0))
%25 = tail call i32 @dlclose(i32* %10)
%26 = call i32 @sprintf(i8* %4, i8* dereferenceable(1) getelementptr inbounds ([10 x i8], [10 x i8]* @.str.6, i64 0, i64 0), i8* %0)
%27 = tail call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.7, i64 0, i64 0))
%28 = call i32 (i8*, ...) @debug(i8* %4)
%29 = load i32, i32* @RTLD_NOW
%30 = load i32, i32* @RTLD_LOCAL
%31 = or i32 %30, %29
%32 = load i32, i32* @RTLD_NODELETE
%33 = or i32 %31, %32
%34 = call i32* @dlopen(i8* %4, i32 %33)
%35 = icmp eq i32* %34, null
br i1 %35, label %36, label %39
36: ; preds = %23
%37 = call i8* (...) @dlerror()
%38 = call i32 (i8*, ...) @debug(i8* %37)
br label %123
39: ; preds = %23
%40 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.8, i64 0, i64 0))
%41 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.9, i64 0, i64 0))
%42 = call i8* @dlsym(i32* %34, i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.10, i64 0, i64 0))
%43 = icmp eq i8* %42, null
br i1 %43, label %44, label %48
44: ; preds = %39
%45 = call i8* (...) @dlerror()
%46 = call i32 (i8*, ...) @debug(i8* %45)
%47 = call i32 @dlclose(i32* %34)
br label %123
48: ; preds = %39
%49 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.11, i64 0, i64 0))
%50 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.12, i64 0, i64 0))
%51 = call i8* @dlsym(i32* %34, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.13, i64 0, i64 0))
%52 = icmp eq i8* %51, null
br i1 %52, label %53, label %57
53: ; preds = %48
%54 = call i8* (...) @dlerror()
%55 = call i32 (i8*, ...) @debug(i8* %54)
%56 = call i32 @dlclose(i32* %34)
br label %123
57: ; preds = %48
%58 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.14, i64 0, i64 0))
%59 = call i32 @dlclose(i32* %34)
%60 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.15, i64 0, i64 0))
%61 = ptrtoint i8* %18 to i64
%62 = shl i64 %61, 32
%63 = ashr exact i64 %62, 32
%64 = and i64 %63, -4096
%65 = inttoptr i64 %64 to i8*
%66 = load i32, i32* @PROT_READ
%67 = load i32, i32* @PROT_WRITE
%68 = or i32 %67, %66
%69 = load i32, i32* @PROT_EXEC
%70 = or i32 %68, %69
%71 = call i32 @mprotect(i8* %65, i32 8192, i32 %70)
%72 = getelementptr inbounds i8, i8* %18, i64 16
%73 = bitcast i8* %72 to i32*
%74 = load i32, i32* %73
%75 = icmp eq i32 %74, -450891772
br i1 %75, label %78, label %76
76: ; preds = %57
%77 = ptrtoint i8* %42 to i64
br label %104
78: ; preds = %57
%79 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.16, i64 0, i64 0))
%80 = ptrtoint i8* %42 to i64
%81 = shl i64 %80, 32
%82 = ashr exact i64 %81, 32
%83 = and i64 %82, -4096
%84 = inttoptr i64 %83 to i8*
%85 = load i32, i32* @PROT_READ
%86 = load i32, i32* @PROT_WRITE
%87 = or i32 %86, %85
%88 = load i32, i32* @PROT_EXEC
%89 = or i32 %87, %88
%90 = call i32 @mprotect(i8* %84, i32 8192, i32 %89)
%91 = load i32, i32* %73
%92 = getelementptr inbounds i8, i8* %42, i64 36
%93 = bitcast i8* %92 to i32*
store i32 %91, i32* %93
%94 = getelementptr inbounds i8, i8* %18, i64 20
%95 = bitcast i8* %94 to i32*
%96 = load i32, i32* %95
%97 = getelementptr inbounds i8, i8* %42, i64 40
%98 = bitcast i8* %97 to i32*
store i32 %96, i32* %98
%99 = load i32, i32* @PROT_READ
%100 = load i32, i32* @PROT_EXEC
%101 = or i32 %100, %99
%102 = call i32 @mprotect(i8* %84, i32 8192, i32 %101)
%103 = call i32 @cacheflush(i32* %93, i32 8)
br label %104
104: ; preds = %76, %78
%105 = phi i64 [ %77, %76 ], [ %80, %78 ]
store i32 -450891772, i32* %73
%106 = trunc i64 %105 to i32
%107 = getelementptr inbounds i8, i8* %18, i64 20
%108 = bitcast i8* %107 to i32*
store i32 %106, i32* %108
%109 = load i32, i32* @PROT_READ
%110 = load i32, i32* @PROT_EXEC
%111 = or i32 %110, %109
%112 = call i32 @mprotect(i8* %65, i32 8192, i32 %111)
%113 = bitcast i32* %3 to i8*
%114 = call i32 @strlen(i8* %0)
%115 = add nsw i32 %114, 1
%116 = call i8* @malloc(i32 %115)
%117 = call i32 @strcpy(i8* %116, i8* %0)
%118 = call i32 @pthread_create(i32* %3, i32* null, i8* %51, i8* %116)
%119 = load i32, i32* %3
%120 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([43 x i8], [43 x i8]* @.str.17, i64 0, i64 0), i32 %119)
%121 = call i32 @cacheflush(i32* %73, i32 8)
%122 = call i32 (i8*, ...) @debug(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.18, i64 0, i64 0))
br label %123
123: ; preds = %20, %36, %53, %104, %44, %12
ret void
}