glaurung

Fixture 165

bitstream reader

C · 5 functions · 4 lanes · 16 of 20 function-lanes behave identically

2 of 4 lanes have a function that returns a different result after decompilation: clang-O2 (3/5), gcc-O2 (3/5).

A bit-level cursor: MSB-first, fields of arbitrary width laid end to end with no byte alignment between them, exactly as in H.264/AV1 headers, LoRaWAN and ZigBee PHY frames, DEFLATE-style codes and most register-packed firmware telemetry. Bit 0 is the most significant bit of byte 0; a 13-bit field starting at bit 3 occupies the low 5 bits of byte 0, all of byte 1, and does not touch byte 2.

Two readers compute the same thing on purpose: - the bit-at-a-time loop, which is what a naive implementation looks like; - the windowed reader, which touches ceil((skew + width) / 8) bytes, accumulates them into a 32-bit window, and extracts with one shift and one mask. bit165_cross_check asserts they agree, so a decompilation that recovers one of them wrongly is caught even when it looks self-consistent.

Why this stresses a decompiler: the windowed reader's three derived quantities -- skew = bit_off & 7, need = (skew + width + 7) >> 3, and trailing = need * 8 - skew - width -- are pure arithmetic on the cursor, they get folded and re-associated hard by the optimiser, and a decompiler that emits an algebraically *plausible* rearrangement (say, 8 - skew rather than the trailing count, or >> 3 where the source rounded up) still yields correct answers for every byte-aligned field and wrong ones for exactly the fields that cross a byte boundary. That is a bug class that survives every similarity metric and every eyeball, and it is only visible by execution.

UB notes: width is clamped to [1, 24] so no shift count ever reaches 32 and the window can never overflow 32 bits; bit_off is range-checked against limit * 8 BEFORE bit_off + width is formed, so that sum cannot overflow; limit is clamped to [0, 16] first. Every buffer index is derived from an already-validated bit range.

tests/decompiler_fixtures/src/165_bitstream_reader.c source 
/* 165_bitstream_reader.c
 *
 * A bit-level cursor: MSB-first, fields of arbitrary width laid end to end with
 * no byte alignment between them, exactly as in H.264/AV1 headers, LoRaWAN and
 * ZigBee PHY frames, DEFLATE-style codes and most register-packed firmware
 * telemetry. Bit 0 is the most significant bit of byte 0; a 13-bit field
 * starting at bit 3 occupies the low 5 bits of byte 0, all of byte 1, and does
 * not touch byte 2.
 *
 * Two readers compute the same thing on purpose:
 *   - the bit-at-a-time loop, which is what a naive implementation looks like;
 *   - the windowed reader, which touches ceil((skew + width) / 8) bytes,
 *     accumulates them into a 32-bit window, and extracts with one shift and
 *     one mask.
 * `bit165_cross_check` asserts they agree, so a decompilation that recovers one
 * of them wrongly is caught even when it looks self-consistent.
 *
 * Why this stresses a decompiler: the windowed reader's three derived
 * quantities -- `skew = bit_off & 7`, `need = (skew + width + 7) >> 3`, and
 * `trailing = need * 8 - skew - width` -- are pure arithmetic on the cursor,
 * they get folded and re-associated hard by the optimiser, and a decompiler
 * that emits an algebraically *plausible* rearrangement (say, `8 - skew` rather
 * than the trailing count, or `>> 3` where the source rounded up) still yields
 * correct answers for every byte-aligned field and wrong ones for exactly the
 * fields that cross a byte boundary. That is a bug class that survives every
 * similarity metric and every eyeball, and it is only visible by execution.
 *
 * UB notes: width is clamped to [1, 24] so no shift count ever reaches 32 and
 * the window can never overflow 32 bits; `bit_off` is range-checked against
 * `limit * 8` BEFORE `bit_off + width` is formed, so that sum cannot overflow;
 * `limit` is clamped to [0, 16] first. Every buffer index is derived from an
 * already-validated bit range.
 */
#include <stddef.h>
#include <stdint.h>

#define BIT165_MAX_BUF     16
#define BIT165_MAX_WIDTH   24
#define BIT165_FRAME_BYTES 5
#define BIT165_BAD         0xFFFFFFFFu
#define BIT165_SYNC        0x5u

/* Clamp a caller length into [0, BIT165_MAX_BUF] before any arithmetic. */
static int32_t bit165_clamp(int32_t n) {
    if (n < 0) {
        return 0;
    }
    if (n > BIT165_MAX_BUF) {
        return BIT165_MAX_BUF;
    }
    return n;
}

/* 1 iff a `width`-bit field at `bit_off` lies wholly inside `limit` bytes.
 * `limit` is pre-clamped, so `limit * 8` is at most 128 and the `bit_off`
 * range check below makes `bit_off + width` safe to form. */
static int32_t bit165_fits(int32_t limit, int32_t bit_off, int32_t width) {
    int32_t total_bits = limit * 8;

    if (width < 1 || width > BIT165_MAX_WIDTH) {
        return 0;
    }
    if (bit_off < 0 || bit_off > total_bits) {
        return 0;
    }
    return (bit_off + width <= total_bits) ? 1 : 0;
}

/* Reference reader: one bit per iteration, MSB first. */
static uint32_t bit165_pull_bitwise(const uint8_t *buf, int32_t bit_off,
                                    int32_t width) {
    uint32_t acc = 0;
    int32_t i;

    for (i = 0; i < width; i++) {
        int32_t at = bit_off + i;
        uint32_t bit = ((uint32_t)buf[at >> 3] >> (7 - (at & 7))) & 1u;
        acc = (acc << 1) | bit;
    }
    return acc;
}

/* Windowed reader: gather the touched bytes, then one shift and one mask.
 * `need` is at most 4 for width <= 24, so the window holds at most 32 bits. */
static uint32_t bit165_pull_windowed(const uint8_t *buf, int32_t bit_off,
                                     int32_t width) {
    int32_t base = bit_off >> 3;
    int32_t skew = bit_off & 7;
    int32_t need = (skew + width + 7) >> 3;
    int32_t trailing = need * 8 - skew - width;
    uint32_t window = 0;
    int32_t i;

    for (i = 0; i < need; i++) {
        window = (window << 8) | (uint32_t)buf[base + i];
    }
    return (window >> trailing) & ((1u << width) - 1u);
}

/* Write `width` bits of `value`, MSB first, at `bit_off`. The caller must have
 * validated the range with bit165_fits. */
static void bit165_poke(uint8_t *buf, int32_t bit_off, int32_t width,
                        uint32_t value) {
    int32_t i;

    for (i = 0; i < width; i++) {
        int32_t at = bit_off + width - 1 - i;
        int32_t shift = 7 - (at & 7);
        uint32_t bit = (value >> i) & 1u;
        uint32_t byte = (uint32_t)buf[at >> 3];

        if (bit != 0u) {
            byte |= (1u << shift);
        } else {
            byte &= ~(1u << shift);
        }
        buf[at >> 3] = (uint8_t)(byte & 0xFFu);
    }
}

/* Read one field. Returns 0xFFFFFFFF on rejection, which no accepted read can
 * produce because width is capped at 24 bits. */
__attribute__((noinline)) uint32_t
bit165_read_bits(const uint8_t *buf, int32_t len, int32_t bit_off,
                 int32_t width) {
    int32_t limit = bit165_clamp(len);

    if (buf == NULL) {
        return BIT165_BAD;
    }
    if (!bit165_fits(limit, bit_off, width)) {
        return BIT165_BAD;
    }
    return bit165_pull_windowed(buf, bit_off, width);
}

/* 1 when both readers agree, 0 when they disagree, negative when the request
 * is out of range. */
__attribute__((noinline)) int32_t
bit165_cross_check(const uint8_t *buf, int32_t len, int32_t bit_off,
                   int32_t width) {
    int32_t limit = bit165_clamp(len);

    if (buf == NULL) {
        return -1;
    }
    if (!bit165_fits(limit, bit_off, width)) {
        return -2;
    }
    return (bit165_pull_bitwise(buf, bit_off, width) ==
            bit165_pull_windowed(buf, bit_off, width))
               ? 1
               : 0;
}

/* Pull consecutive `width`-bit fields until the buffer or the sink runs out.
 * Returns how many fields were produced. */
__attribute__((noinline)) int32_t
bit165_read_sequence(const uint8_t *buf, int32_t len, int32_t width,
                     int32_t *out, int32_t out_len) {
    int32_t limit = bit165_clamp(len);
    int32_t room = bit165_clamp(out_len);
    int32_t field_bits = width;
    int32_t count = 0;
    int32_t bit_off = 0;

    if (buf == NULL || out == NULL) {
        return -1;
    }
    if (field_bits < 1) {
        field_bits = 1;
    }
    if (field_bits > BIT165_MAX_WIDTH) {
        field_bits = BIT165_MAX_WIDTH;
    }
    while (count < room && bit165_fits(limit, bit_off, field_bits)) {
        out[count] = (int32_t)bit165_pull_windowed(buf, bit_off, field_bits);
        count++;
        bit_off += field_bits;
    }
    return count;
}

/* Lay out a 5-byte frame: 3-bit sync at bit 0, a 13-bit field at bit 3 (which
 * ends exactly on the byte-2 boundary), and a 19-bit field at bit 16 (which
 * ends 5 bits into byte 4). Returns the byte sum of the frame. */
__attribute__((noinline)) int32_t
bit165_write_frame(uint8_t *out, int32_t out_len, uint32_t small,
                   uint32_t large) {
    int32_t room = bit165_clamp(out_len);
    int32_t sum = 0;
    int32_t i;

    if (out == NULL) {
        return -1;
    }
    if (room < BIT165_FRAME_BYTES) {
        return -2;
    }
    for (i = 0; i < BIT165_FRAME_BYTES; i++) {
        out[i] = 0;
    }
    bit165_poke(out, 0, 3, BIT165_SYNC);
    bit165_poke(out, 3, 13, small);
    bit165_poke(out, 16, 19, large);
    for (i = 0; i < BIT165_FRAME_BYTES; i++) {
        sum += (int32_t)out[i];
    }
    return sum;
}

/* Write a frame into a local and read every field back: 1 for the sync, 2 for
 * the 13-bit field, 4 for the 19-bit field, 8 when both readers agree on the
 * boundary-crossing one. A perfect roundtrip returns 15. */
__attribute__((noinline)) int32_t
bit165_roundtrip(uint32_t small, uint32_t large) {
    uint8_t frame[BIT165_MAX_BUF];
    int32_t result = 0;
    int32_t rc;
    int32_t i;

    for (i = 0; i < BIT165_MAX_BUF; i++) {
        frame[i] = 0;
    }
    rc = bit165_write_frame(frame, BIT165_FRAME_BYTES, small, large);
    if (rc < 0) {
        return rc;
    }
    if (bit165_read_bits(frame, BIT165_FRAME_BYTES, 0, 3) == BIT165_SYNC) {
        result += 1;
    }
    if (bit165_read_bits(frame, BIT165_FRAME_BYTES, 3, 13) ==
        (small & 0x1FFFu)) {
        result += 2;
    }
    if (bit165_read_bits(frame, BIT165_FRAME_BYTES, 16, 19) ==
        (large & 0x7FFFFu)) {
        result += 4;
    }
    if (bit165_cross_check(frame, BIT165_FRAME_BYTES, 3, 13) == 1) {
        result += 8;
    }
    return result;
}

Recovered C

Generated by glaurung decompile --style decbench at b47f6b43. baseline.json records the result after recompiling the C and calling it beside the original with seeded inputs.

clang -O2

3/5
bit165_cross_check pass 129 lines 
// glaurung: bit165_cross_check @ 0x11f0
int32_t bit165_cross_check(const uint8_t * arg0, int32_t arg1, int32_t arg2, int32_t arg3) {
    int total_bits;
    unsigned int acc;
    int i;
    int skew;
    int need;
    int at;
    int base;
    unsigned int bit;
    int limit;
    int trailing;
    unsigned int window;
    long ret;
    long var1;
    long var101;
    long var105;
    long var107;
    long var110;
    long var112;
    long var114;
    long var12;
    long var120;
    long var122;
    long var123;
    long var128;
    long var15;
    long var2;
    long var32;
    long var49;
    int var53;
    long var55;
    long var56;
    int var61;
    long var81;
    long var87;
    int var89;
    long var90;
    long var93;
    var1 = (((long)(arg1) < 16) ? arg1 : 16);
    if ((arg0 == 0)) {
        return 0xffffffff;
    }
    var2 = (unsigned long)((unsigned int)(arg3));
    ret = 0xfffffffe;
    if (((unsigned long)((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(arg3)) - 25)))) < (unsigned long)(0xffffffe8))) {
        return ret;
    }
    if (((long)(arg2) < 0)) {
        return ret;
    }
    total_bits = (unsigned long)((unsigned int)((((0 <= (long)((int)(var1))) ? var1 : 0) << 3)));
    if ((total_bits < arg2)) {
        return ret;
    }
    if (((unsigned long)((unsigned long)((unsigned int)(total_bits))) < (unsigned long)((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(arg3)) + arg2)))))) {
        return ret;
    }
    if (((unsigned long)((unsigned int)(arg3)) != 1)) {
        var12 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var2)) & -2)));
        acc = 0;
        var15 = (unsigned long)((unsigned int)(arg2));
        i = 0;
        do {
            var32 = (unsigned long)((unsigned int)((var15 + 1)));
            var49 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)((unsigned char)(arg0[(long)((int)(((int)(var15) >> 3)))]))) >> ((~((unsigned long)((unsigned int)(var15)) & 255)) & 7)))) & 1)));
            acc = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var49 + var49))) + (acc * 4)))) | (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)((unsigned char)(arg0[(long)((int)(((int)(var32) >> 3)))]))) >> ((~(var32 & 255)) & 7)))) & 1))))));
            var53 = (i + 2);
            i = (unsigned long)((unsigned int)(var53));
            var15 = (unsigned long)((unsigned int)((var15 + 2)));
        } while (((unsigned int)(var12) != (unsigned int)(var53)));
        var55 = (unsigned long)((unsigned int)((acc + acc)));
        var56 = (unsigned long)(acc);
        if (((unsigned long)((unsigned char)((var2 & 1))) == 0)) {
            goto L_12e5;
        }
        goto L_12c0;
    } else {
        var55 = 0;
        i = 0;
        if (((unsigned long)((unsigned char)((var2 & 1))) != 0)) {
            L_12c0: ;
            var61 = (i + arg2);
            var56 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)((unsigned char)(arg0[(long)((int)(((int)(var61) >> 3)))]))) >> ((unsigned long)((unsigned int)(((~((unsigned long)((unsigned int)(var61)) & 255)) & 7))) & 31)))) & 1))) | var55)));
        } else {
            var56 = var81;
        }
    }
    L_12e5: ;
    skew = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(arg2)) & 7)));
    var87 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)((skew + var2))) + 7)));
    var89 = ((unsigned int)(skew) + var2);
    var90 = (unsigned long)((unsigned int)(var89));
    if ((((unsigned long)((unsigned int)(var89)) == 0) | ((long)((int)(var89)) < 0))) {
        var93 = 0;
    } else {
        need = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var87)) >> 3)));
        var101 = (long)((int)(((int)(arg2) >> 3)));
        var105 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(need)) & 3)));
        if (((unsigned long)(3) <= (unsigned long)((need - 1)))) {
            var107 = (unsigned long)((unsigned int)((need & -4)));
            var110 = 0;
            do {
                var110 = (var110 + 4);
            } while ((var107 != var110));
            var112 = (unsigned long)((unsigned int)(*(int *)(((var110 + (var101 + (long)arg0)) - 4))));
            var114 = (unsigned int)(((((((unsigned int)(var112) & 255) << 24) | ((((unsigned int)(var112) >> 8) & 255) << 16)) | ((((unsigned int)(var112) >> 16) & 255) << 8)) | (((unsigned int)(var112) >> 24) & 255)));
        } else {
            var110 = 0;
            var114 = 0;
        }
        skew = var110;
        var93 = var114;
        if ((var105 != 0)) {
            var120 = (long)(((long)arg0 + (var110 + var101)));
            var122 = 0;
            var123 = var114;
            while ((var105 != var122)) {
                var128 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var123 << 8))) | (unsigned int)((unsigned char)(*(char *)((var120 + var122)))))));
                var122 = (var122 + 1);
                var123 = var128;
                skew = var122;
                var93 = var128;
            }
        }
    }
    // x86-64 epilogue: tear down frame
    return ((unsigned int)(var56) == (unsigned int)(((~(unsigned long)((unsigned int)((0xffffffff << ((unsigned long)((unsigned int)(var2)) & 31))))) & (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var93)) >> ((unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var87 & 248))) - var90))) & 31)))))));
}
bit165_read_bits pass 60 lines 
// glaurung: bit165_read_bits @ 0x1130
uint32_t bit165_read_bits(const uint8_t * arg0, int32_t arg1, int32_t arg2, int32_t arg3) {
    int total_bits;
    int skew;
    int base;
    int i;
    int limit;
    int trailing;
    unsigned int window;
    long ret;
    long var0;
    long var15;
    int var17;
    long var18;
    long var2;
    long var22;
    int var24;
    long var25;
    long var31;
    long var37;
    var0 = (unsigned long)((unsigned int)(arg3));
    var2 = (((long)(arg1) < 16) ? arg1 : 16);
    ret = 0xffffffff;
    if ((arg0 == 0)) {
        return ret;
    }
    if (((unsigned long)((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(arg3)) - 25)))) < (unsigned long)(0xffffffe8))) {
        return ret;
    }
    if (((long)(arg2) < 0)) {
        return ret;
    }
    total_bits = (unsigned long)((unsigned int)((((0 <= (long)((int)(var2))) ? var2 : 0) << 3)));
    if ((total_bits < arg2)) {
        return ret;
    }
    if (((unsigned long)((unsigned long)((unsigned int)(total_bits))) < (unsigned long)((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(arg3)) + arg2)))))) {
        return ret;
    }
    skew = (unsigned long)((unsigned int)((arg2 & 7)));
    var15 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(skew)) + (unsigned long)((unsigned int)(arg3)))));
    var17 = ((unsigned int)((skew + (unsigned long)((unsigned int)(arg3)))) + 7);
    var18 = (unsigned long)((unsigned int)(var17));
    var22 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var17)) >> 3)));
    base = ((unsigned long)((unsigned int)(arg2)) >> 3);
    var24 = (unsigned int)((unsigned char)(*(char *)(((long)arg0 + base))));
    var25 = (unsigned long)((unsigned int)(var24));
    if (((unsigned long)((unsigned int)(var22)) != 1)) {
        var31 = (unsigned long)((unsigned int)(((unsigned int)((unsigned char)(*(char *)((base + (long)arg0 + 0x1)))) | (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var24)) << 8))))));
        var25 = var31;
        if (((unsigned long)((unsigned int)(var22)) != 2)) {
            var37 = (unsigned long)((unsigned int)(((unsigned int)((unsigned char)(*(char *)((base + (long)arg0 + 0x2)))) | (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var31)) << 8))))));
            var25 = var37;
            if (((unsigned long)((unsigned int)(var22)) != 3)) {
                var25 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var37 << 8))) | (unsigned int)((unsigned char)(*(char *)((base + (long)arg0 + 0x3)))))));
            }
        }
    }
    return (unsigned int)(((~(unsigned long)((unsigned int)((0xffffffff << ((unsigned long)((unsigned int)(var0)) & 31))))) & (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var25)) >> ((unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var18 & 248))) - var15))) & 31))))));
}
bit165_read_sequence pass 103 lines 
// glaurung: bit165_read_sequence @ 0x1390
int32_t bit165_read_sequence(const uint8_t * arg0, int32_t arg1, int32_t arg2, int32_t * arg3, int32_t arg4) {
    int field_bits;
    int count;
    int base;
    int bit_off;
    int i;
    int limit;
    int skew;
    int total_bits;
    int trailing;
    unsigned int window;
    long ret;
    long var1;
    long var17;
    long var18;
    long var19;
    long var24;
    long var25;
    long var27;
    long var29;
    long var33;
    long var39;
    long var4;
    long var42;
    int var47;
    int var5;
    long var51;
    int var53;
    long var59;
    long var6;
    long var65;
    long var7;
    long var8;
    int var9;
    var1 = ((16 <= (long)(arg1)) ? 16 : arg1);
    var4 = ((0 <= (long)((int)(var1))) ? var1 : 0);
    var5 = (((long)(arg4) < 16) ? arg4 : 16);
    var6 = 0xffffffff;
    ret = 0xffffffff;
    if ((arg0 == 0)) {
        // x86-64 epilogue: tear down frame
        return ret;
    }
    var7 = (long)arg3;
    ret = var6;
    if ((arg3 == 0)) {
        // x86-64 epilogue: tear down frame
        return ret;
    }
    var8 = 1;
    var9 = ((((unsigned long)((unsigned int)(arg2)) == 0) | ((long)(arg2) < 0)) ? 1 : arg2);
    field_bits = (((unsigned long)((unsigned long)((unsigned int)(var9))) < (unsigned long)(24)) ? var9 : 24);
    if ((((unsigned long)((unsigned int)(arg4)) == 0) | ((long)(arg4) < 0))) {
        // x86-64 epilogue: tear down frame
        return 0;
    }
    var17 = (unsigned long)((unsigned int)((var4 << 3)));
    var18 = (~(unsigned long)((unsigned int)((0xffffffff << ((unsigned long)((unsigned int)(field_bits)) & 31)))));
    var19 = ((2 <= (long)((int)(var5))) ? var5 : var8);
    var24 = 0;
    var25 = 0;
    goto L_1428;
    L_1410: ;
    *(int *)((var7 + var25 * 4)) = ((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var33)) >> ((unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var27 & 120))) - var29))) & 31)))) & var18);
    count = (var25 + 1);
    var25 = (unsigned long)((unsigned int)(count));
    ret = var19;
    if ((var19 == count)) {
        // x86-64 epilogue: tear down frame
        return ret;
    }
    L_1428: ;
    var39 = (unsigned long)((unsigned int)(var24));
    var24 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var24)) + field_bits)));
    if (((unsigned long)((unsigned long)((unsigned int)(var17))) < (unsigned long)((unsigned long)((unsigned int)(var24))))) {
        // x86-64 epilogue: tear down frame
        return (unsigned int)(var25);
    }
    var42 = (unsigned long)((unsigned int)((var39 & 7)));
    var29 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var42)) + field_bits)));
    var47 = ((unsigned int)((var42 + field_bits)) + 7);
    var27 = (unsigned long)((unsigned int)(var47));
    var51 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var47)) >> 3)));
    base = ((unsigned long)((unsigned int)(var39)) >> 3);
    var53 = (unsigned int)((unsigned char)(*(char *)(((long)arg0 + base))));
    var33 = (unsigned long)((unsigned int)(var53));
    if (((unsigned long)((unsigned int)(var51)) == 1)) {
        goto L_1410;
    }
    var59 = (unsigned long)((unsigned int)(((unsigned int)((unsigned char)(*(char *)((base + (long)arg0 + 0x1)))) | (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var53)) << 8))))));
    var33 = var59;
    if (((unsigned long)((unsigned int)(var51)) == 2)) {
        goto L_1410;
    }
    var65 = (unsigned long)((unsigned int)(((unsigned int)((unsigned char)(*(char *)((base + (long)arg0 + 0x2)))) | (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var59)) << 8))))));
    var33 = var65;
    if (((unsigned long)((unsigned int)(var51)) == 3)) {
        goto L_1410;
    }
    var33 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var65 << 8))) | (unsigned int)((unsigned char)(*(char *)((base + (long)arg0 + 0x3)))))));
    goto L_1410;
}
bit165_roundtrip fail 43 lines 
// glaurung: bit165_roundtrip @ 0x1590
__attribute__((no_stack_protector)) int32_t bit165_roundtrip(uint32_t arg0, uint32_t arg1) {
    extern int bit165_cross_check(char *, int, int, int);
    extern unsigned int bit165_read_bits(char *, int, int, int);
    extern int bit165_write_frame(char *, int, unsigned int, unsigned int);
    int rc;
    int i;
    int result;
    unsigned char local_38[56];
    long rsp;
    long var0;
    long var1;
    unsigned int var10;
    long var15;
    unsigned int var16;
    long var21;
    unsigned int var22;
    long var27;
    int var28;
    int var7;
    // x86-64 prologue: save callee registers, frame 40 bytes
    rsp = (rsp - 16);
    var0 = (unsigned long)(arg1);
    var1 = (unsigned long)(arg0);
    *(int *)(&local_38[0]) = 0;
    *(int *)((&local_38[0] + 4)) = 0;
    *(int *)((&local_38[0] + 8)) = 0;
    *(int *)((&local_38[0] + 12)) = 0;
    var7 = bit165_write_frame((char *)(rsp), 5, arg0, arg1);
    rc = (unsigned long)((unsigned int)(var7));
    if ((0 <= (long)((int)(var7)))) {
        var10 = bit165_read_bits((char *)(&local_38[0]), 5, 0, 3);
        var15 = (var10 == 5);
        var16 = bit165_read_bits((char *)(&local_38[0]), 5, 3, 13);
        var21 = ((var16 != (unsigned long)((unsigned int)((var1 & 0x1fff)))) ? var15 : (unsigned long)((unsigned int)((var15 + 2))));
        var22 = bit165_read_bits((char *)(&local_38[0]), 5, 16, 19);
        var27 = ((var22 != (unsigned long)((unsigned int)((var0 & 0x7ffff)))) ? var21 : (unsigned long)((unsigned int)((var21 + 4))));
        var28 = bit165_cross_check((char *)(&local_38[0]), 5, 3, 13);
        rc = (((unsigned long)((unsigned int)(var28)) != 1) ? var27 : (unsigned long)((unsigned int)((var27 + 8))));
    }
    // x86-64 epilogue: restore callee registers
    return rc;
}
bit165_write_frame fail 55 lines 
// glaurung: bit165_write_frame @ 0x14a0
int32_t bit165_write_frame(uint8_t * arg0, int32_t arg1, uint32_t arg2, uint32_t arg3) {
    extern long __unknown(long, ...);
    int i;
    int sum;
    long ret;
    long var1;
    long var10;
    int var18;
    long var2;
    long var20;
    long var21;
    long var23;
    int var24;
    long var29;
    int var37;
    long var4;
    int var47;
    int var48;
    int var5;
    if ((arg0 == 0)) {
        return 0xffffffff;
    }
    ret = 0xfffffffe;
    if (((long)(arg1) < 5)) {
        return ret;
    }
    *(int *)(((long)arg0 + 0x1)) = 0;
    *(signed char *)(((long)arg0)) = -96;
    var1 = 0;
    var2 = 15;
    do {
        var4 = ((unsigned long)((unsigned int)(var2)) >> 3);
        var5 = (unsigned int)((unsigned char)(*(char *)(((long)arg0 + var4))));
        var10 = ((~((unsigned long)((unsigned int)(var2)) & 255)) & 7);
        *(signed char *)(((long)arg0 + var4)) = ((((unsigned long)(arg2) >> (var1 & 31)) & 1) ? (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var5)) | ((unsigned int)(1) << (var10 & 31))))) : (unsigned long)((unsigned int)((var5 & (~((unsigned int)(1) << (var10 & 31)))))));
        var1 = (unsigned long)((unsigned int)((var1 + 1)));
        var18 = (var2 - 1);
        var2 = (unsigned long)((unsigned int)(var18));
    } while (((unsigned long)((unsigned int)(var18)) != 2));
    var20 = 0;
    var21 = 34;
    do {
        var23 = ((unsigned long)((unsigned int)(var21)) >> 3);
        var24 = (unsigned int)((unsigned char)(*(char *)(((long)arg0 + var23))));
        var29 = ((~((unsigned long)((unsigned int)(var21)) & 255)) & 7);
        *(signed char *)(((long)arg0 + var23)) = ((((unsigned long)(arg3) >> (var20 & 31)) & 1) ? (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var24)) | ((unsigned int)(1) << (var29 & 31))))) : (unsigned long)((unsigned int)((var24 & (~((unsigned int)(1) << (var29 & 31)))))));
        var20 = (unsigned long)((unsigned int)((var20 + 1)));
        var37 = (var21 - 1);
        var21 = (unsigned long)((unsigned int)(var37));
    } while (((unsigned long)((unsigned int)(var37)) != 15));
    var47 = __unknown(0);
    var48 = __unknown(0);
    return (unsigned int)(((unsigned long)((unsigned int)(((((unsigned int)((unsigned short)((((unsigned int)(var48) >> 16) & 0xffff))) | ((unsigned int)(0) << 16)) + ((unsigned int)((unsigned short)((((unsigned int)(var47) >> 16) & 0xffff))) | ((unsigned int)(0) << 16))) + (((unsigned int)((unsigned short)(var48)) | ((unsigned int)(0) << 16)) + ((unsigned int)((unsigned short)(var47)) | ((unsigned int)(0) << 16)))))) + (unsigned int)((unsigned char)(*(char *)(((long)arg0 + 0x4))))));
}

gcc -O2

3/5
bit165_cross_check pass 49 lines 
// glaurung: bit165_cross_check @ 0x1240
int32_t bit165_cross_check(const uint8_t * arg0, int32_t arg1, int32_t arg2, int32_t arg3) {
    extern unsigned int bit165_pull_windowed(char *, int, int);
    unsigned int acc;
    int at;
    long ret;
    long var0;
    long var1;
    long var10;
    long var11;
    long var14;
    long var15;
    long var16;
    int var19;
    long var34;
    unsigned int var35;
    long var4;
    long var8;
    var0 = (unsigned long)((unsigned int)(arg2));
    var1 = (unsigned long)((unsigned int)(arg3));
    if ((arg0 == 0)) {
        return 0xffffffff;
    }
    ret = 0xfffffffe;
    if (((unsigned long)(23) < (unsigned long)((unsigned long)((unsigned int)((arg3 - 1)))))) {
        return ret;
    }
    var4 = (((((unsigned long)((unsigned int)(arg1)) == 16) | ((long)(arg1) < 16)) == 0) ? 16 : arg1);
    var8 = (unsigned long)((unsigned int)(arg2));
    var10 = (unsigned long)((unsigned int)(((((long)((int)(var4)) < 0) ? 0 : var4) << 3)));
    if (((unsigned long)((unsigned long)((unsigned int)(var10))) < (unsigned long)((unsigned long)((unsigned int)(arg2))))) {
        return ret;
    }
    var11 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(arg2)) + arg3)));
    if (((long)((int)(var10)) < (long)((int)(var11)))) {
        return ret;
    }
    var14 = 0;
    do {
        var15 = (unsigned long)((unsigned int)(var8));
        var16 = (unsigned long)((unsigned int)(var8));
        var19 = (var8 + 1);
        var8 = (unsigned long)((unsigned int)(var19));
        var34 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var14 + var14))) | (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)((unsigned char)(arg0[(long)((int)(((int)(var15) >> 3)))]))) >> ((unsigned long)((unsigned int)(((~var16) & 7))) & 31)))) & 1))))));
        var14 = var34;
    } while (((unsigned int)(var11) != (unsigned int)(var19)));
    var35 = bit165_pull_windowed((char *)(arg0), (unsigned long)((unsigned int)(var0)), (unsigned long)((unsigned int)(var1)));
    return ((unsigned int)(var35) == (unsigned int)(var34));
}
bit165_read_bits fail 22 lines 
// glaurung: bit165_read_bits @ 0x11f0
unsigned int bit165_read_bits(char * arg0, int arg1, int arg2, int arg3, long arg4, long arg5) {
    extern unsigned int bit165_pull_windowed(char *, int, int, int, long, long);
    unsigned int ret;
    long var10;
    long var5;
    if ((arg0 != 0)) {
        if (((unsigned long)(23) < (unsigned long)((unsigned long)((unsigned int)((arg3 - 1)))))) {
            return 0xffffffff;
        }
        var5 = (((((unsigned long)((unsigned int)(arg1)) == 16) | ((long)(arg1) < 16)) == 0) ? 16 : (unsigned long)((unsigned int)(arg1)));
        var10 = (unsigned long)((unsigned int)(((((long)((int)(var5)) < 0) ? 0 : var5) << 3)));
        if (((unsigned long)((unsigned long)((unsigned int)(var10))) < (unsigned long)((unsigned long)((unsigned int)(arg2))))) {
            return 0xffffffff;
        }
        if (((long)((int)(((unsigned long)((unsigned int)(arg2)) + (unsigned long)((unsigned int)(arg3))))) <= (long)((int)(var10)))) {
            ret = bit165_pull_windowed(arg0, arg1, arg2, arg3, arg4, arg5);
            return ret;
        }
    }
    return 0xffffffff;
}
bit165_read_sequence pass 79 lines 
// glaurung: bit165_read_sequence @ 0x12d0
int32_t bit165_read_sequence(const uint8_t * arg0, int32_t arg1, int32_t arg2, int32_t * arg3, int32_t arg4) {
    extern unsigned int bit165_pull_windowed(char *, int, int);
    int room;
    int field_bits;
    int total_bits;
    int count;
    int bit_off;
    long local_10;
    long local_18;
    long local_20;
    long local_30;
    long local_8;
    long ret;
    long var1;
    long var10;
    int var11;
    long var2;
    long var22;
    long var25;
    long var3;
    char * var30;
    unsigned int var36;
    int var38;
    long var6;
    long var7;
    long var8;
    local_8 = var1;
    local_10 = var2;
    var3 = (((((unsigned long)((unsigned int)(arg1)) == 16) | ((long)(arg1) < 16)) == 0) ? 16 : arg1);
    local_18 = var6;
    local_20 = var7;
    var8 = (((long)((int)(var3)) < 0) ? 0 : var3);
    local_30 = var10;
    var11 = ((((unsigned long)((unsigned int)(arg4)) == 16) | ((long)(arg4) < 16)) ? arg4 : 16);
    room = (((long)((int)(var11)) < 0) ? 0 : (unsigned long)((unsigned int)(var11)));
    if ((arg0 == 0)) {
        // x86-64 epilogue: tear down frame
        return 0xffffffff;
    }
    var22 = (long)arg3;
    if ((arg3 == 0)) {
        // x86-64 epilogue: tear down frame
        return 0xffffffff;
    }
    var25 = ((((unsigned long)((unsigned int)(arg2)) == 24) | ((long)(arg2) < 24)) ? arg2 : 24);
    field_bits = ((((unsigned long)((unsigned int)(var25)) == 0) | ((long)((int)(var25)) < 0)) ? 1 : var25);
    if ((((unsigned long)((unsigned int)(arg4)) == 0) | ((long)(arg4) < 0))) {
        // x86-64 epilogue: tear down frame
        return 0;
    }
    total_bits = (unsigned long)((unsigned int)((var8 * 8)));
    if (((((unsigned int)(field_bits) == (unsigned int)(total_bits)) | (field_bits < total_bits)) == 0)) {
        // x86-64 epilogue: tear down frame
        return 0;
    }
    var30 = (char *)arg0;
    count = 1;
    bit_off = 0;
    while (1) {
        var36 = bit165_pull_windowed(var30, (unsigned long)((unsigned int)(bit_off)), (unsigned long)((unsigned int)(field_bits)));
        *(int *)((var22 + count * 4 - 0x4)) = var36;
        ret = (unsigned long)((unsigned int)(count));
        if (((((unsigned int)(room) == (unsigned int)(count)) | (room < count)) != 0)) {
            break;
        }
        var38 = (bit_off + field_bits);
        bit_off = (unsigned long)((unsigned int)(var38));
        if ((total_bits < var38)) {
            break;
        }
        count = (count + 1);
        if (((long)(total_bits) < (long)((int)((field_bits + bit_off))))) {
            break;
        }
    }
    // x86-64 epilogue: tear down frame
    return ret;
}
bit165_roundtrip fail 58 lines 
// glaurung: bit165_roundtrip @ 0x1480
__attribute__((no_stack_protector)) int32_t bit165_roundtrip(uint32_t arg0, uint32_t arg1) {
    extern int bit165_cross_check(char *, int, int, int);
    extern unsigned int bit165_read_bits(char *, int, int, int);
    extern int bit165_write_frame(char *, int, unsigned int, unsigned int);
    int i;
    int rc;
    int result;
    long rbp;
    long rsp;
    long stack_2;
    unsigned char stack_5[16];
    int var13;
    long var16;
    unsigned int var18;
    long var23;
    long var25;
    unsigned int var26;
    long var30;
    unsigned int var31;
    long var41;
    int var43;
    long var7;
    long var9;
    rsp = (rsp - 8);
    rsp = (rsp - 8);
    var7 = (unsigned long)(arg1);
    rsp = (rsp - 8);
    stack_2 = rbp;
    rsp = (rsp - 8);
    var9 = (unsigned long)(arg0);
    rsp = (rsp - 40);
    // stack canary: save guard to %stack_4
    rbp = rsp;
    *(int *)(&stack_5[0]) = 0;
    *(int *)((&stack_5[0] + 4)) = 0;
    *(int *)((&stack_5[0] + 8)) = 0;
    *(int *)((&stack_5[0] + 12)) = 0;
    var13 = ((int (*)(char *))bit165_write_frame)((char *)(rsp));
    var16 = (unsigned long)((unsigned int)(var13));
    if ((0 <= (long)((int)(var13)))) {
        var18 = bit165_read_bits((char *)(rbp), 5, 0, 3);
        var23 = (var18 == 5);
        var25 = (unsigned long)((unsigned int)((var9 & 0x1fff)));
        var26 = bit165_read_bits((char *)(rbp), 5, 3, 13);
        var30 = ((var26 == (unsigned long)((unsigned int)(var25))) ? (unsigned long)((unsigned int)((var23 + 2))) : var23);
        var31 = bit165_read_bits((char *)(rbp), 5, 16, 19);
        var41 = ((var31 == (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var7)) & 0x7ffff)))) ? (unsigned long)((unsigned int)((var30 + 4))) : var30);
        var43 = ((int (*)(void))bit165_cross_check)();
        var16 = (((unsigned long)((unsigned int)(var43)) == 1) ? (unsigned long)((unsigned int)((var41 + 8))) : var41);
    }
    // stack-canary check
    rsp = (rsp + 40);
    rsp = (rsp + 8);
    rbp = stack_2;
    // x86-64 epilogue: tear down frame
    return (unsigned int)(var16);
}
bit165_write_frame pass 76 lines 
// glaurung: bit165_write_frame @ 0x1390
int32_t bit165_write_frame(uint8_t * arg0, int32_t arg1, uint32_t arg2, uint32_t arg3) {
    int i;
    unsigned int byte;
    int sum;
    int at;
    unsigned int bit;
    int shift;
    long ret;
    long var0;
    long var1;
    long var19;
    long var25;
    int var33;
    int var36;
    int var39;
    int var4;
    int var40;
    long var41;
    int var5;
    long var54;
    long var60;
    int var61;
    int var68;
    int var71;
    long var72;
    long var75;
    long var76;
    int var77;
    if ((arg0 == 0)) {
        return 0xffffffff;
    }
    if ((((unsigned long)((unsigned int)(arg1)) == 4) | ((long)(arg1) < 4))) {
        return 0xfffffffe;
    }
    var0 = (unsigned long)(arg2);
    var1 = (unsigned long)(arg3);
    var4 = 15;
    var5 = 1;
    *(int *)(((long)arg0 + 0x1)) = 0;
    *(signed char *)(((long)arg0)) = -96;
    i = 0;
    do {
        var19 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var5)) << ((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(i)) & 7))) & 31))));
        var25 = (long)(((long)((int)(((int)(((unsigned long)((unsigned int)(var4)) - i)) >> 3))) + (long)arg0));
        byte = (unsigned int)((unsigned char)(*(char *)((var25))));
        var33 = ((unsigned int)(((unsigned long)((unsigned int)(var0)) >> ((unsigned long)((unsigned int)(i)) & 31))) & 1);
        var36 = (i + 1);
        i = (unsigned long)((unsigned int)(var36));
        *(signed char *)((var25)) = (((unsigned long)((unsigned int)(var33)) != 0) ? (unsigned long)((unsigned int)((byte | var19))) : (unsigned long)((unsigned int)(((~var19) & byte))));
    } while (((unsigned long)((unsigned int)(var36)) != 13));
    var39 = 34;
    var40 = 1;
    var41 = 0;
    do {
        var54 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var40)) << ((unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var41 - 35))) & 7))) & 31))));
        var60 = (long)(((long)((int)(((int)(((unsigned long)((unsigned int)(var39)) - var41)) >> 3))) + (long)arg0));
        var61 = (unsigned int)((unsigned char)(*(char *)((var60))));
        var68 = ((unsigned int)(((unsigned long)((unsigned int)(var1)) >> ((unsigned long)((unsigned int)(var41)) & 31))) & 1);
        var71 = (var41 + 1);
        var41 = (unsigned long)((unsigned int)(var71));
        *(signed char *)((var60)) = (((unsigned long)((unsigned int)(var68)) != 0) ? (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var61)) | var54))) : (unsigned long)((unsigned int)(((~var54) & var61))));
    } while (((unsigned long)((unsigned int)(var71)) != 19));
    var72 = (long)((arg0 + 5));
    var75 = 0;
    var76 = (long)arg0;
    do {
        var77 = (unsigned int)((unsigned char)(*(char *)((var76))));
        var76 = (var76 + 1);
        sum = (var75 + var77);
        ret = (unsigned long)((unsigned int)(sum));
        var75 = (unsigned long)((unsigned int)(sum));
    } while ((var76 != var72));
    // x86-64 epilogue: tear down frame
    return ret;
}

clang -O0

5/5
bit165_cross_check pass 29 lines 
// glaurung: bit165_cross_check @ 0x1310
int32_t bit165_cross_check(const uint8_t * arg0, int32_t arg1, int32_t arg2, int32_t arg3) {
    extern int bit165_clamp(int);
    extern int bit165_fits(int, int, int);
    extern unsigned int bit165_pull_bitwise(char *, int, int);
    extern unsigned int bit165_pull_windowed(char *, int, int);
    int limit;
    int local_24;
    int var0;
    int var2;
    unsigned int var4;
    unsigned int var6;
    // x86-64 prologue: save rbp, frame 48 bytes
    var0 = bit165_clamp((unsigned long)((unsigned int)(arg1)));
    limit = var0;
    if ((arg0 != 0)) {
        var2 = bit165_fits((unsigned long)((unsigned int)(limit)), (unsigned long)((unsigned int)(arg2)), (unsigned long)((unsigned int)(arg3)));
        if (((unsigned long)((unsigned int)(var2)) != 0)) {
            var4 = bit165_pull_bitwise((char *)(arg0), (unsigned long)((unsigned int)(arg2)), (unsigned long)((unsigned int)(arg3)));
            local_24 = var4;
            var6 = bit165_pull_windowed((char *)(arg0), (unsigned long)((unsigned int)(arg2)), (unsigned long)((unsigned int)(arg3)));
            return (unsigned int)(((unsigned int)(local_24) == (unsigned int)(var6)) ? 1 : 0);
        } else {
            return (unsigned int)(-2);
        }
    } else {
        return (unsigned int)(-1);
    }
}
bit165_read_bits pass 24 lines 
// glaurung: bit165_read_bits @ 0x1130
uint32_t bit165_read_bits(const uint8_t * arg0, int32_t arg1, int32_t arg2, int32_t arg3) {
    extern int bit165_clamp(int);
    extern int bit165_fits(int, int, int);
    extern unsigned int bit165_pull_windowed(char *, int, int);
    int limit;
    int var0;
    int var2;
    unsigned int var4;
    // x86-64 prologue: save rbp, frame 32 bytes
    var0 = bit165_clamp((unsigned long)((unsigned int)(arg1)));
    limit = var0;
    if ((arg0 != 0)) {
        var2 = bit165_fits((unsigned long)((unsigned int)(limit)), (unsigned long)((unsigned int)(arg2)), (unsigned long)((unsigned int)(arg3)));
        if (((unsigned long)((unsigned int)(var2)) != 0)) {
            var4 = bit165_pull_windowed((char *)(arg0), (unsigned long)((unsigned int)(arg2)), (unsigned long)((unsigned int)(arg3)));
            return (unsigned int)(var4);
        } else {
            return (unsigned int)(-1);
        }
    } else {
        return (unsigned int)(-1);
    }
}
bit165_read_sequence pass 56 lines 
// glaurung: bit165_read_sequence @ 0x1430
int32_t bit165_read_sequence(const uint8_t * arg0, int32_t arg1, int32_t arg2, int32_t * arg3, int32_t arg4) {
    extern int bit165_clamp(int);
    extern int bit165_fits(int, int, int);
    extern unsigned int bit165_pull_windowed(char *, int, int);
    int limit;
    int room;
    int field_bits;
    int count;
    int bit_off;
    signed char local_39;
    int local_4;
    int var0;
    unsigned int var14;
    int var2;
    int var8;
    var0 = bit165_clamp((unsigned long)((unsigned int)(arg1)));
    limit = var0;
    var2 = bit165_clamp((unsigned long)((unsigned int)(arg4)));
    room = var2;
    field_bits = arg2;
    count = 0;
    bit_off = 0;
    if ((arg0 != 0)) {
        if ((arg3 != 0)) {
            goto L_1496;
        }
    }
    local_4 = -1;
    // x86-64 epilogue: restore rbp
    return (unsigned int)(local_4);
    L_1496: ;
    if (((long)(field_bits) < 1)) {
        field_bits = 1;
    }
    if (((((unsigned long)((unsigned int)(field_bits)) == 24) | ((long)(field_bits) < 24)) == 0)) {
        field_bits = 24;
    }
    goto L_14bd;
    L_14bd: ;
    local_39 = 0;
    if ((count < room)) {
        var8 = bit165_fits((unsigned long)((unsigned int)(limit)), (unsigned long)((unsigned int)(bit_off)), (unsigned long)((unsigned int)(field_bits)));
        local_39 = ((unsigned long)((unsigned int)(var8)) != 0);
    }
    if (((unsigned long)((unsigned char)((local_39 & 1))) != 0)) {
        var14 = bit165_pull_windowed((char *)(arg0), (unsigned long)((unsigned int)(bit_off)), (unsigned long)((unsigned int)(field_bits)));
        arg3[(long)(count)] = var14;
        count = ((unsigned int)(count) + 1);
        bit_off = ((unsigned int)(field_bits) + bit_off);
        goto L_14bd;
    }
    local_4 = count;
    // x86-64 epilogue: restore rbp
    return (unsigned int)(local_4);
}
bit165_roundtrip pass 43 lines 
// glaurung: bit165_roundtrip @ 0x1710
__attribute__((no_stack_protector)) int32_t bit165_roundtrip(uint32_t arg0, uint32_t arg1) {
    extern int bit165_cross_check(char *, int, int, int);
    extern unsigned int bit165_read_bits(char *, int, int, int);
    extern int bit165_write_frame(char *, int, unsigned int, unsigned int);
    int result;
    int i;
    int rc;
    unsigned char local_20[16];
    unsigned int var12;
    unsigned int var20;
    int var28;
    int var4;
    unsigned int var7;
    // x86-64 prologue: save rbp, frame 48 bytes
    result = 0;
    for (i = 0; ((long)(i) < 16); i++) {
        *(signed char *)((&local_20[0] + (long)(i))) = 0;
    }
    var4 = bit165_write_frame((char *)(&local_20[0]), 5, arg0, arg1);
    rc = var4;
    if ((0 <= (long)(rc))) {
        var7 = bit165_read_bits((char *)(&local_20[0]), 5, 0, 3);
        if ((var7 == 5)) {
            result = ((unsigned int)(result) + 1);
        }
        var12 = bit165_read_bits((char *)(&local_20[0]), 5, 3, 13);
        if ((var12 == (unsigned long)((unsigned int)((arg0 & 0x1fff))))) {
            result = ((unsigned int)(result) + 2);
        }
        var20 = bit165_read_bits((char *)(&local_20[0]), 5, 16, 19);
        if ((var20 == (unsigned long)((unsigned int)((arg1 & 0x7ffff))))) {
            result = ((unsigned int)(result) + 4);
        }
        var28 = bit165_cross_check((char *)(&local_20[0]), 5, 3, 13);
        if (((unsigned long)((unsigned int)(var28)) == 1)) {
            result = ((unsigned int)(result) + 8);
        }
        return (unsigned int)(result);
    } else {
        return (unsigned int)(rc);
    }
}
bit165_write_frame pass 31 lines 
// glaurung: bit165_write_frame @ 0x1540
int32_t bit165_write_frame(uint8_t * arg0, int32_t arg1, uint32_t arg2, uint32_t arg3) {
    extern int bit165_clamp(int);
    extern void bit165_poke(char *, int, int, unsigned int);
    int room;
    int sum;
    int i;
    int var0;
    // x86-64 prologue: save rbp, frame 48 bytes
    var0 = bit165_clamp((unsigned long)((unsigned int)(arg1)));
    room = var0;
    sum = 0;
    if ((arg0 != 0)) {
        if ((5 <= (long)(room))) {
            for (i = 0; ((long)(i) < 5); i++) {
                arg0[i] = 0;
            }
            bit165_poke((char *)(arg0), 0, 3, 5);
            bit165_poke((char *)(arg0), 3, 13, arg2);
            bit165_poke((char *)(arg0), 16, 19, arg3);
            for (i = 0; ((long)(i) < 5); i++) {
                sum = ((unsigned int)((unsigned char)(arg0[i])) + sum);
            }
            return (unsigned int)(sum);
        } else {
            return (unsigned int)(-2);
        }
    } else {
        return (unsigned int)(-1);
    }
}

gcc -O0

5/5
bit165_cross_check pass 29 lines 
// glaurung: bit165_cross_check @ 0x1433
int32_t bit165_cross_check(const uint8_t * arg0, int32_t arg1, int32_t arg2, int32_t arg3) {
    extern int bit165_clamp(int);
    extern int bit165_fits(int, int, int);
    extern unsigned int bit165_pull_bitwise(char *, int, int);
    extern unsigned int bit165_pull_windowed(char *, int, int);
    int limit;
    int var1;
    long var11;
    unsigned int var14;
    int var5;
    unsigned int var9;
    // x86-64 prologue: save rbp, frame 8 bytes
    var1 = bit165_clamp((unsigned long)((unsigned int)(arg1)));
    limit = var1;
    if ((arg0 != 0)) {
        var5 = bit165_fits((unsigned long)((unsigned int)(limit)), (unsigned long)((unsigned int)(arg2)), (unsigned long)((unsigned int)(arg3)));
        if (((unsigned long)((unsigned int)(var5)) != 0)) {
            var9 = bit165_pull_bitwise((char *)(arg0), (unsigned long)((unsigned int)(arg2)), (unsigned long)((unsigned int)(arg3)));
            var11 = (unsigned long)(var9);
            var14 = bit165_pull_windowed((char *)(arg0), (unsigned long)((unsigned int)(arg2)), (unsigned long)((unsigned int)(arg3)));
            return ((unsigned int)(var11) == (unsigned int)(var14));
        } else {
            return 0xfffffffe;
        }
    } else {
        return 0xffffffff;
    }
}
bit165_read_bits pass 24 lines 
// glaurung: bit165_read_bits @ 0x13cc
uint32_t bit165_read_bits(const uint8_t * arg0, int32_t arg1, int32_t arg2, int32_t arg3) {
    extern int bit165_clamp(int);
    extern int bit165_fits(int, int, int);
    extern unsigned int bit165_pull_windowed(char *, int, int);
    int limit;
    int var1;
    int var5;
    unsigned int var9;
    // x86-64 prologue: save rbp, frame 40 bytes
    var1 = bit165_clamp((unsigned long)((unsigned int)(arg1)));
    limit = var1;
    if ((arg0 != 0)) {
        var5 = bit165_fits((unsigned long)((unsigned int)(limit)), (unsigned long)((unsigned int)(arg2)), (unsigned long)((unsigned int)(arg3)));
        if (((unsigned long)((unsigned int)(var5)) != 0)) {
            var9 = bit165_pull_windowed((char *)(arg0), (unsigned long)((unsigned int)(arg2)), (unsigned long)((unsigned int)(arg3)));
            return var9;
        } else {
            return 0xffffffff;
        }
    } else {
        return 0xffffffff;
    }
}
bit165_read_sequence pass 49 lines 
// glaurung: bit165_read_sequence @ 0x14bd
int32_t bit165_read_sequence(const uint8_t * arg0, int32_t arg1, int32_t arg2, int32_t * arg3, int32_t arg4) {
    extern int bit165_clamp(int);
    extern int bit165_fits(int, int, int);
    extern unsigned int bit165_pull_windowed(char *, int, int);
    int limit;
    int room;
    int field_bits;
    int count;
    int bit_off;
    int var1;
    int var10;
    unsigned int var14;
    int var4;
    // x86-64 prologue: save rbp, frame 64 bytes
    var1 = bit165_clamp((unsigned long)((unsigned int)(arg1)));
    limit = var1;
    var4 = bit165_clamp((unsigned long)((unsigned int)(arg4)));
    room = var4;
    field_bits = arg2;
    count = 0;
    bit_off = 0;
    if ((arg0 == 0)) {
        // x86-64 epilogue: restore rbp
        return 0xffffffff;
    }
    if ((arg3 == 0)) {
        // x86-64 epilogue: restore rbp
        return 0xffffffff;
    }
    if (((((unsigned long)((unsigned int)(field_bits)) == 0) | ((long)(field_bits) < 0)) != 0)) {
        field_bits = 1;
    }
    if (((((unsigned long)((unsigned int)(field_bits)) == 24) | ((long)(field_bits) < 24)) == 0)) {
        field_bits = 24;
    }
    while ((count < room)) {
        var10 = bit165_fits((unsigned long)((unsigned int)(limit)), (unsigned long)((unsigned int)(bit_off)), (unsigned long)((unsigned int)(field_bits)));
        if (((unsigned long)((unsigned int)(var10)) == 0)) {
            break;
        }
        var14 = bit165_pull_windowed((char *)(arg0), (unsigned long)((unsigned int)(bit_off)), (unsigned long)((unsigned int)(field_bits)));
        arg3[(long)(count)] = var14;
        count = (count + 1);
        bit_off = (bit_off + (unsigned int)(field_bits));
    }
    // x86-64 epilogue: restore rbp
    return (unsigned int)(count);
}
bit165_roundtrip pass 52 lines 
// glaurung: bit165_roundtrip @ 0x1682
int32_t bit165_roundtrip(uint32_t arg0, uint32_t arg1) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern int bit165_cross_check(char *, int, int, int);
    extern unsigned int bit165_read_bits(char *, int, int, int);
    extern int bit165_write_frame(char *, int, unsigned int, unsigned int);
    int result;
    int i;
    int rc;
    unsigned char local_20[16];
    long local_8;
    long ret;
    unsigned int var12;
    unsigned int var18;
    int var24;
    int var6;
    unsigned int var9;
    // x86-64 prologue: save rbp, frame 64 bytes
    local_8 = (long)(0x28);
    result = 0;
    for (i = 0; ((((unsigned long)((unsigned int)(i)) == 15) | ((long)(i) < 15)) != 0); i++) {
        *(signed char *)((&local_20[0] + (long)(i))) = 0;
    }
    var6 = bit165_write_frame((char *)(&local_20[0]), 5, arg0, arg1);
    rc = var6;
    if ((0 <= (long)(rc))) {
        var9 = bit165_read_bits((char *)(&local_20[0]), 5, 0, 3);
        if ((var9 == 5)) {
            result = (result + 1);
        }
        var12 = bit165_read_bits((char *)(&local_20[0]), 5, 3, 13);
        if ((var12 == (unsigned long)((unsigned int)((arg0 & 0x1fff))))) {
            result = (result + 2);
        }
        var18 = bit165_read_bits((char *)(&local_20[0]), 5, 16, 19);
        if ((var18 == (unsigned long)((unsigned int)((arg1 & 0x7ffff))))) {
            result = (result + 4);
        }
        var24 = bit165_cross_check((char *)(&local_20[0]), 5, 3, 13);
        if (((unsigned long)((unsigned int)(var24)) == 1)) {
            result = (result + 8);
        }
        ret = (unsigned long)((unsigned int)(result));
    } else {
        ret = (unsigned long)((unsigned int)(rc));
    }
    if ((local_8 != 0x28)) {
        __stack_chk_fail();
    }
    // x86-64 epilogue: restore rbp
    return ret;
}
bit165_write_frame pass 31 lines 
// glaurung: bit165_write_frame @ 0x1592
int32_t bit165_write_frame(uint8_t * arg0, int32_t arg1, uint32_t arg2, uint32_t arg3) {
    extern int bit165_clamp(int);
    extern void bit165_poke(char *, int, int, unsigned int);
    int room;
    int sum;
    int i;
    int var1;
    // x86-64 prologue: save rbp, frame 40 bytes
    var1 = bit165_clamp((unsigned long)((unsigned int)(arg1)));
    room = var1;
    sum = 0;
    if ((arg0 != 0)) {
        if (((((unsigned long)((unsigned int)(room)) == 4) | ((long)(room) < 4)) == 0)) {
            for (i = 0; ((((unsigned long)((unsigned int)(i)) == 4) | ((long)(i) < 4)) != 0); i++) {
                arg0[i] = 0;
            }
            bit165_poke((char *)(arg0), 0, 3, 5);
            bit165_poke((char *)(arg0), 3, 13, arg2);
            bit165_poke((char *)(arg0), 16, 19, arg3);
            for (i = 0; ((((unsigned long)((unsigned int)(i)) == 4) | ((long)(i) < 4)) != 0); i++) {
                sum = (sum + (unsigned int)((unsigned char)(((unsigned int)((unsigned char)(arg0[i])) & 255))));
            }
            return (unsigned int)(sum);
        } else {
            return 0xfffffffe;
        }
    } else {
        return 0xffffffff;
    }
}

← 213 fixtures