#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ F_OK;
int access(char *, int /*<<< orphan*/);
int dladdr_check();
int /*<<< orphan*/ dlinfo_check();
scalar_t__ getenv(char *);
int /*<<< orphan*/ printf(char *, ...);
int main(void) {
  if (getenv("LD_PRELOAD"))
    printf("OK.. LD_PRELOAD is visible in the local environment variables.. "
           "little warning\n");
  if (access("/etc/ld.so.preload", F_OK) != -1)
    printf("OK.. /etc/ld.so.preload DOES definitely exist.. little warning\n");
  printf("[+] finished basic checks\n\n");
  dlinfo_check();
  printf("\n");
  int hooked_funcs = dladdr_check();
  if (hooked_funcs > 0)
    printf("[!] the dladdr check revealed that there are %d possibly hooked "
           "functions. YOUR MALWARE SUUUUCKS.\n",
           hooked_funcs);
  if (hooked_funcs == 0)
    printf("[+] no modifications to any libc functions were found. no "
           "LD_PRELOAD malware loaded, or your malware is decent.\n");
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
movl   $0x0,-0x4(%rbp)
lea    0xe9a(%rip),%rdi
call   1030 <getenv@plt>
cmp    $0x0,%rax
je     1183 <main+0x33>
lea    0xe8f(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    0x2e4e(%rip),%rax
mov    (%rax),%esi
lea    0xec8(%rip),%rdi
call   1070 <access@plt>
cmp    $0xffffffff,%eax
je     11af <main+0x5f>
lea    0xec6(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xef8(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0x0,%al
call   1040 <dlinfo_check@plt>
lea    0xefd(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0x0,%al
call   1060 <dladdr_check@plt>
mov    %eax,-0x8(%rbp)
cmpl   $0x0,-0x8(%rbp)
jle    11f7 <main+0xa7>
mov    -0x8(%rbp),%esi
lea    0xeda(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
cmpl   $0x0,-0x8(%rbp)
jne    120f <main+0xbf>
lea    0xf25(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
xor    %eax,%eax
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rax
lea    0xe88(%rip),%rdi
call   1030 <getenv@plt>
test   %rax,%rax
je     118e <main+0x1e>
lea    0xfc2(%rip),%rdi
call   1050 <puts@plt>
mov    0x2e43(%rip),%rax
mov    (%rax),%esi
lea    0xe6d(%rip),%rdi
call   1090 <access@plt>
cmp    $0xffffffff,%eax
je     11b4 <main+0x44>
lea    0xf5d(%rip),%rdi
call   1050 <puts@plt>
lea    0xec6(%rip),%rdi
call   1050 <puts@plt>
xor    %eax,%eax
call   1060 <dlinfo_check@plt>
mov    $0xa,%edi
call   1040 <putchar@plt>
xor    %eax,%eax
call   1080 <dladdr_check@plt>
test   %eax,%eax
jle    11ee <main+0x7e>
lea    0xe3b(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1070 <printf@plt>
jmp    11fc <main+0x8c>
jne    11fc <main+0x8c>
lea    0xea5(%rip),%rdi
call   1050 <puts@plt>
xor    %eax,%eax
pop    %rcx
ret

LLVM IR (-O0):
@.str = [11 x i8] c"LD_PRELOAD\00"
@.str.1 = [80 x i8] c"OK.. LD_PRELOAD is visible in the local environment variables.. little warning\0A\00"
@.str.2 = [19 x i8] c"/etc/ld.so.preload\00"
@F_OK = global i32 0
@.str.3 = [64 x i8] c"OK.. /etc/ld.so.preload DOES definitely exist.. little warning\0A\00"
@.str.4 = [28 x i8] c"[+] finished basic checks\0A\0A\00"
@.str.5 = [2 x i8] c"\0A\00"
@.str.6 = [99 x i8] c"[!] the dladdr check revealed that there are %d possibly hooked functions. YOUR MALWARE SUUUUCKS.\0A\00"
@.str.7 = [113 x i8] c"[+] no modifications to any libc functions were found. no LD_PRELOAD malware loaded, or your malware is decent.\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
store i32 0, i32* %1
%3 = call i64 @getenv(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0))
%4 = icmp ne i64 %3, 0
br i1 %4, label %5, label %7
5: ; preds = %0
%6 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([80 x i8], [80 x i8]* @.str.1, i64 0, i64 0))
br label %7
7: ; preds = %5, %0
%8 = load i32, i32* @F_OK
%9 = call i32 @access(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.2, i64 0, i64 0), i32 %8)
%10 = icmp ne i32 %9, -1
br i1 %10, label %11, label %13
11: ; preds = %7
%12 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([64 x i8], [64 x i8]* @.str.3, i64 0, i64 0))
br label %13
13: ; preds = %11, %7
%14 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.4, i64 0, i64 0))
%15 = call i32 (...) @dlinfo_check()
%16 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.5, i64 0, i64 0))
%17 = call i32 (...) @dladdr_check()
store i32 %17, i32* %2
%18 = load i32, i32* %2
%19 = icmp sgt i32 %18, 0
br i1 %19, label %20, label %23
20: ; preds = %13
%21 = load i32, i32* %2
%22 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([99 x i8], [99 x i8]* @.str.6, i64 0, i64 0), i32 %21)
br label %23
23: ; preds = %20, %13
%24 = load i32, i32* %2
%25 = icmp eq i32 %24, 0
br i1 %25, label %26, label %28
26: ; preds = %23
%27 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([113 x i8], [113 x i8]* @.str.7, i64 0, i64 0))
br label %28
28: ; preds = %26, %23
ret i32 0
}

LLVM IR (-O2):
@.str = [11 x i8] c"LD_PRELOAD\00"
@.str.2 = [19 x i8] c"/etc/ld.so.preload\00"
@F_OK = global i32 0
@.str.6 = [99 x i8] c"[!] the dladdr check revealed that there are %d possibly hooked functions. YOUR MALWARE SUUUUCKS.\0A\00"
@str = [27 x i8] c"[+] finished basic checks\0A\00"
@str.8 = [112 x i8] c"[+] no modifications to any libc functions were found. no LD_PRELOAD malware loaded, or your malware is decent.\00"
@str.9 = [63 x i8] c"OK.. /etc/ld.so.preload DOES definitely exist.. little warning\00"
@str.10 = [79 x i8] c"OK.. LD_PRELOAD is visible in the local environment variables.. little warning\00"
define i32 @main() {
%1 = tail call i64 @getenv(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0))
%2 = icmp eq i64 %1, 0
br i1 %2, label %5, label %3
3: ; preds = %0
%4 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([79 x i8], [79 x i8]* @str.10, i64 0, i64 0))
br label %5
5: ; preds = %3, %0
%6 = load i32, i32* @F_OK
%7 = tail call i32 @access(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.2, i64 0, i64 0), i32 %6)
%8 = icmp eq i32 %7, -1
br i1 %8, label %11, label %9
9: ; preds = %5
%10 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([63 x i8], [63 x i8]* @str.9, i64 0, i64 0))
br label %11
11: ; preds = %9, %5
%12 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([27 x i8], [27 x i8]* @str, i64 0, i64 0))
%13 = tail call i32 (...) @dlinfo_check()
%14 = tail call i32 @putchar(i32 10)
%15 = tail call i32 (...) @dladdr_check()
%16 = icmp sgt i32 %15, 0
br i1 %16, label %17, label %19
17: ; preds = %11
%18 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([99 x i8], [99 x i8]* @.str.6, i64 0, i64 0), i32 %15)
br label %23
19: ; preds = %11
%20 = icmp eq i32 %15, 0
br i1 %20, label %21, label %23
21: ; preds = %19
%22 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([112 x i8], [112 x i8]* @str.8, i64 0, i64 0))
br label %23
23: ; preds = %17, %21, %19
ret i32 0
}