#include <assert.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <inttypes.h>

#include <map>
#include <set>
#include <vector>
#include <string>

#include <capstone.h>

#include "elf.h"

#define INSPECT_FUNCTION_POINTERS 0 // set this to 1 when testing a new program, to verify that no false function pointers are found

#ifndef TRACE
#define TRACE 0
#endif

#define LABELS_64_BIT 1

#define MAX(a, b) ((a) > (b) ? (a) : (b))
#define MIN(a, b) ((a) < (b) ? (a) : (b))

#define u32be(x) (uint32_t)(((x & 0xff) << 24) + ((x & 0xff00) << 8) + ((x & 0xff0000) >> 8) + ((uint32_t)(x) >> 24))
#define u16be(x) (uint16_t)(((x & 0xff) << 8) + ((x & 0xff00) >> 8))
#define read_u32_be(buf) (uint32_t)(((buf)[0] << 24) + ((buf)[1] << 16) + ((buf)[2] << 8) + ((buf)[3]))

using namespace std;

struct Edge {
    uint32_t i;
    uint8_t function_entry: 1;
    uint8_t function_exit: 1;
    uint8_t extern_function: 1;
    uint8_t function_pointer: 1;
};

struct Insn {
    uint32_t id;
    uint8_t op_count;
    string mnemonic;
    string op_str;
    cs_mips_op operands[8];

    uint8_t is_jump: 1;
    uint8_t is_global_got_memop: 1;
    uint8_t no_following_successor: 1;
    int linked_insn;
    union {
        uint32_t linked_value;
        float linked_float;
    };
    uint32_t jtbl_addr;
    uint32_t num_cases;
    mips_reg index_reg;
    vector<Edge> successors;
    vector<Edge> predecessors;
    uint64_t b_liveout;
    uint64_t b_livein;
    uint64_t f_livein;
    uint64_t f_liveout;
};

struct Function {
    vector<uint32_t> returns; //points to delay slots
    uint32_t end_addr; //address after end
    uint32_t nargs;
    uint32_t nret;
    bool v0_in;
    bool referenced_by_function_pointer;
};

static bool conservative;

static csh handle;

static const uint8_t *text_section;
static uint32_t text_section_len;
static uint32_t text_vaddr;

static const uint8_t *rodata_section;
static uint32_t rodata_section_len;
static uint32_t rodata_vaddr;

static const uint8_t *data_section;
static uint32_t data_section_len;
static uint32_t data_vaddr;

static uint32_t bss_section_len;
static uint32_t bss_vaddr;

static vector<Insn> insns;
static set<uint32_t> label_addresses;
static vector<uint32_t> got_globals;
static vector<uint32_t> got_locals;
static uint32_t gp_value;
static uint32_t gp_value_adj;

static map<uint32_t, string> symbol_names;

static vector<pair<uint32_t, uint32_t>> data_function_pointers;
static set<uint32_t> li_function_pointers;
static map<uint32_t, Function> functions;
static uint32_t main_addr;
static uint32_t mcount_addr;
static uint32_t procedure_table_start;
static uint32_t procedure_table_len;

#define FLAG_NO_MEM 1
#define FLAG_VARARG 2

static const struct {
    const char *name;
    const char *params;
    int flags;
} extern_functions[] = {
    {"exit", "vi"}, // override exit from application
    {"abort", "v"},
    {"sbrk", "pi"},
    {"malloc", "pu"},
    {"calloc", "puu"},
    {"realloc", "ppu"},
    {"free", "vp"},
    {"fscanf", "ipp", FLAG_VARARG},
    {"printf", "ip", FLAG_VARARG},
    {"sprintf", "ipp", FLAG_VARARG},
    {"fprintf", "ipp", FLAG_VARARG},
    {"_doprnt", "ippp"},
    {"strlen", "up"},
    {"open", "ipii"},
    {"creat", "ipi"},
    {"access", "ipi"},
    {"rename", "ipp"},
    {"utime", "ipp"},
    {"flock", "iii"},
    {"chmod", "ipu"},
    {"umask", "ii", FLAG_NO_MEM},
    {"ecvt", "pdipp"},
    {"fcvt", "pdipp"},
    {"sqrt", "dd", FLAG_NO_MEM},
    {"sqrtf", "ff", FLAG_NO_MEM},
    {"atoi", "ip"},
    {"atol", "ip"},
    {"atof", "dp"},
    {"strtol", "ippi"},
    {"strtoul", "uppi"},
    {"strtod", "dpp"},
    {"strchr", "ppi"},
    {"strrchr", "ppi"},
    {"strcspn", "upp"},
    {"strpbrk", "ppp"},
    {"fstat", "iip"},
    {"stat", "ipp"},
    {"ftruncate", "iii"},
    {"bcopy", "vppu"},
    {"memcpy", "pppu"},
    {"memccpy", "pppiu"},
    {"read", "iipu"},
    {"write", "iipu"},
    {"fopen", "ppp"},
    {"freopen", "pppp"},
    {"fclose", "ip"},
    {"ftell", "ip"},
    {"rewind", "vp"},
    {"fseek", "ipii"},
    {"lseek", "iiii"},
    {"fflush", "ip"},
    {"dup", "ii"},
    {"dup2", "iii"},
    {"pipe", "ip"},
    {"perror", "vp"},
    {"fdopen", "iip"},
    {"memset", "ppiu"},
    {"bcmp", "ippu"},
    {"memcmp", "ippu"},
    {"getpid", "i", FLAG_NO_MEM},
    {"getpgrp", "i"},
    {"remove", "ip"},
    {"unlink", "ip"},
    {"close", "ii"},
    {"strcmp", "ipp"},
    {"strncmp", "ippu"},
    {"strcpy", "ppp"},
    {"strncpy", "pppu"},
    {"strcat", "ppp"},
    {"strncat", "pppu"},
    {"strtok", "ppp"},
    {"strstr", "ppp"},
    {"strdup", "pp"},
    {"toupper", "ii", FLAG_NO_MEM},
    {"tolower", "ii", FLAG_NO_MEM},
    {"gethostname", "ipu"},
    {"isatty", "ii"},
    {"strftime", "upupp"},
    {"times", "ip"},
    {"clock", "i", FLAG_NO_MEM},
    {"ctime", "pp"},
    {"localtime", "pp"},
    {"setvbuf", "ippiu"},
    {"__semgetc", "ip"},
    {"__semputc", "iip"},
    {"fgetc", "ip"},
    {"fgets", "ipip"},
    {"__filbuf", "ip"},
    {"__flsbuf", "iip"},
    {"ungetc", "iip"},
    {"gets", "pp"},
    {"fread", "upuup"},
    {"fwrite", "upuup"},
    {"fputs", "ipp"},
    {"puts", "ip"},
    {"getcwd", "ppu"},
    {"time", "ip"},
    {"bzero", "vpu"},
    {"fp_class_d", "id", FLAG_NO_MEM},
    {"ldexp", "ddi", FLAG_NO_MEM},
    {"__ll_mul", "lll", FLAG_NO_MEM},
    {"__ll_div", "lll", FLAG_NO_MEM},
    {"__ll_rem", "ljl", FLAG_NO_MEM},
    {"__ll_lshift", "llj", FLAG_NO_MEM},
    {"__ll_rshift", "llj", FLAG_NO_MEM},
    {"__ull_div", "jjj", FLAG_NO_MEM},
    {"__ull_rem", "jjj", FLAG_NO_MEM},
    {"__ull_rshift", "jjj", FLAG_NO_MEM},
    {"__d_to_ull", "jd", FLAG_NO_MEM},
    {"__d_to_ll", "ld", FLAG_NO_MEM},
    {"__f_to_ull", "jf", FLAG_NO_MEM},
    {"__f_to_ll", "lf", FLAG_NO_MEM},
    {"__ull_to_f", "fj", FLAG_NO_MEM},
    {"__ll_to_f", "fl", FLAG_NO_MEM},
    {"__ull_to_d", "dj", FLAG_NO_MEM},
    {"__ll_to_d", "dl", FLAG_NO_MEM},
    {"_exit", "vi"},
    {"_cleanup", "v"},
    {"_rld_new_interface", "pu", FLAG_VARARG},
    {"_exithandle", "v"},
    {"_prctl", "ii", FLAG_VARARG},
    {"_atod", "dpii"},
    {"pathconf", "ipi"},
    {"getenv", "pp"},
    {"gettxt", "ppp"},
    {"setlocale", "pip"},
    {"mmap", "ppuiiii"},
    {"munmap", "ipu"},
    {"mprotect", "ipui"},
    {"sysconf", "ii"},
    {"getpagesize", "i"},
    {"strerror", "pi"},
    {"ioctl", "iiu", FLAG_VARARG},
    {"fcntl", "iii", FLAG_VARARG},
    {"signal", "pit"},
    {"sigset", "pit"},
    {"get_fpc_csr", "i"},
    {"set_fpc_csr", "ii"},
    {"setjmp", "ip"},
    {"longjmp", "vpi"},
    {"tempnam", "ppp"},
    {"tmpnam", "pp"},
    {"mktemp", "pp"},
    {"mkstemp", "ip"},
    {"tmpfile", "p"},
    {"wait", "ip"},
    {"kill", "iii"},
    {"execlp", "ip", FLAG_VARARG},
    {"execv", "ipp"},
    {"execvp", "ipp"},
    {"fork", "i"},
    {"system", "ip"},
    {"tsearch", "pppp"},
    {"tfind", "pppp"},
    {"qsort", "vpuut"},
    {"regcmp", "pp", FLAG_VARARG},
    {"regex", "ppp", FLAG_VARARG},
    {"__assert", "vppi"},
};

static void disassemble(void) {
    csh handle;
    cs_insn *disasm;
    static size_t disasm_size;
    assert(cs_open(CS_ARCH_MIPS, (cs_mode)(CS_MODE_MIPS64 | CS_MODE_BIG_ENDIAN), &handle) == CS_ERR_OK);
    cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON);
    disasm_size = cs_disasm(handle, text_section, text_section_len, text_vaddr, 0, &disasm);
    for (size_t i = 0; i < disasm_size; i++) {
        insns.push_back(Insn());
        Insn& insn = insns.back();
        insn.id = disasm[i].id;
        insn.mnemonic = disasm[i].mnemonic;
        insn.op_str = disasm[i].op_str;
        if (disasm[i].detail != nullptr && disasm[i].detail->mips.op_count > 0) {
            insn.op_count = disasm[i].detail->mips.op_count;
            memcpy(insn.operands, disasm[i].detail->mips.operands, sizeof(insn.operands));
        }
        insn.is_jump = cs_insn_group(handle, &disasm[i], MIPS_GRP_JUMP) || insn.id == MIPS_INS_JAL || insn.id == MIPS_INS_BAL || insn.id == MIPS_INS_JALR;
        insn.linked_insn = -1;
    }
    cs_free(disasm, disasm_size);
    cs_close(&handle);

    {
        // Add dummy instruction to avoid out of bounds
        insns.push_back(Insn());
        Insn& insn = insns.back();
        insn.id = MIPS_INS_NOP;
        insn.mnemonic = "nop";
        insn.no_following_successor = true;
    }
}

static void add_function(uint32_t addr) {
    if (addr >= text_vaddr && addr < text_vaddr + text_section_len) {
        functions[addr];
    }
}

static map<uint32_t, Function>::iterator find_function(uint32_t addr) {
    if (functions.size() == 0) {
        return functions.end();
    }
    auto it = functions.upper_bound(addr);
    if (it == functions.begin()) {
        return functions.end();
    }
    --it;
    return it;
}

// try to find a matching LUI for a given register
static void link_with_lui(int offset, uint32_t reg, int mem_imm)
{
#define MAX_LOOKBACK 128
    // don't attempt to compute addresses for zero offset
    // end search after some sane max number of instructions
    int end_search = MAX(0, offset - MAX_LOOKBACK);
    for (int search = offset - 1; search >= end_search; search--) {
        // use an `if` instead of `case` block to allow breaking out of the `for` loop
        if (insns[search].id == MIPS_INS_LUI) {
            uint32_t rd = insns[search].operands[0].reg;
            if (reg == rd) {
                break;
            }
        } else if (insns[search].id == MIPS_INS_LW ||
                        insns[search].id == MIPS_INS_LD ||
                        insns[search].id == MIPS_INS_ADDIU ||
                        //insns[search].id == MIPS_INS_ADDU || used in jump tables for offset
                        insns[search].id == MIPS_INS_ADD ||
                        insns[search].id == MIPS_INS_SUB ||
                        insns[search].id == MIPS_INS_SUBU) {
            uint32_t rd = insns[search].operands[0].reg;
            if (reg == rd) {
                if (insns[search].id == MIPS_INS_LW && insns[search].operands[1].mem.base == MIPS_REG_GP) {
                    int mem_imm0 = (int)insns[search].operands[1].mem.disp;
                    uint32_t got_entry = (mem_imm0 + gp_value_adj) / sizeof(uint32_t);
                    if (got_entry < got_locals.size()) {
                        // used for static functions
                        char buf[32];
                        uint32_t addr = got_locals[got_entry] + mem_imm;
                        insns[search].linked_insn = offset;
                        insns[search].linked_value = addr;
                        insns[offset].linked_insn = search;
                        insns[offset].linked_value = addr;

                        //vaddr_references[addr].insert(text_vaddr + offset * 4);

                        insns[search].id = MIPS_INS_LI;
                        insns[search].mnemonic = "li";
                        sprintf(buf, "$%s, 0x%x", cs_reg_name(handle, rd), addr);
                        insns[search].op_str = buf;
                        insns[search].operands[1].type = MIPS_OP_IMM;
                        insns[search].operands[1].imm = addr;

                        switch (insns[offset].id) {
                            case MIPS_INS_ADDIU:
                                insns[offset].id = MIPS_INS_MOVE;
                                insns[offset].operands[1].type = MIPS_OP_REG;
                                insns[offset].mnemonic = "move";
                                sprintf(buf, "$%s, $%s", cs_reg_name(handle, insns[offset].operands[0].reg), cs_reg_name(handle, rd));
                                insns[offset].op_str = buf;
                                if (addr >= text_vaddr && addr < text_vaddr + text_section_len) {
                                    add_function(addr);
                                }
                                break;
                            case MIPS_INS_LB:
                            case MIPS_INS_LBU:
                            case MIPS_INS_SB:
                            case MIPS_INS_LH:
                            case MIPS_INS_LHU:
                            case MIPS_INS_SH:
                            case MIPS_INS_LW:
                            case MIPS_INS_SW:
                            case MIPS_INS_LDC1:
                            case MIPS_INS_LWC1:
                            case MIPS_INS_SWC1:
                                insns[offset].operands[1].mem.disp = 0;
                                sprintf(buf, "$%s, ($%s)", cs_reg_name(handle, insns[offset].operands[0].reg), cs_reg_name(handle, rd));
                                insns[offset].op_str = buf;
                                break;
                            default:
                                assert(0);
                        }
                    }
                    break;
                } else {
                    // ignore: reg is pointer, offset is probably struct data member
                    break;
                }
            }
        } else if (insns[search].id == MIPS_INS_JR &&
                insns[search].operands[0].reg == MIPS_REG_RA && offset - search >= 2) {
            // stop looking when previous `jr ra` is hit,
            // but ignore if `offset` is branch delay slot for this `jr ra`
            break;
        }
    }
}

// for a given `jalr t9`, find the matching t9 load
static void link_with_jalr(int offset)
{
    // end search after some sane max number of instructions
    int end_search = MAX(0, offset - MAX_LOOKBACK);
    for (int search = offset - 1; search >= end_search; search--) {
        if (insns[search].operands[0].reg == MIPS_REG_T9) {
            if (insns[search].id == MIPS_INS_LW || insns[search].id == MIPS_INS_LI) {
                if (insns[search].is_global_got_memop || insns[search].id == MIPS_INS_LI) {
                    char buf[32];
                    sprintf(buf, "0x%x", insns[search].linked_value);
                    insns[search].linked_insn = offset;
                    insns[offset].linked_insn = search;
                    insns[offset].linked_value = insns[search].linked_value;
                    //insns[offset].label = insns[search].label;
                    //function_entry_points.insert(insns[search].linked_value);
                    insns[offset].id = MIPS_INS_JAL;
                    insns[offset].mnemonic = "jal";
                    insns[offset].op_str = buf;
                    insns[offset].operands[0].type = MIPS_OP_IMM;
                    insns[offset].operands[0].imm = insns[search].linked_value;
                    insns[search].id = MIPS_INS_NOP;
                    insns[search].mnemonic = "nop";
                    insns[search].op_str = "";
                    insns[search].is_global_got_memop = false;
                    add_function(insns[search].linked_value);
                }
                break;
            } else if (insns[search].id == MIPS_INS_ADDIU) {
                if (insns[search].linked_insn != -1) {
                    //function_entry_points.insert(insns[search].linked_value);
                    uint32_t first = insns[search].linked_insn;
                    insns[search].linked_insn = offset;
                    insns[offset].linked_insn = first;
                    insns[offset].linked_value = insns[search].linked_value;
                }
                break;
            } else if (insns[search].id == MIPS_INS_LI) {
                if (insns[search].linked_insn != -1) {
                    //function_entry_points.insert(insns[search].linked_value);
                    uint32_t first = insns[search].linked_insn;
                    insns[search].linked_insn = offset;
                    insns[offset].linked_insn = first;
                    insns[offset].linked_value = insns[search].linked_value;
                    insns[search].id = MIPS_INS_NOP;
                    insns[search].mnemonic = "nop";
                    insns[search].op_str = "";
                }
                break;
            } else if (insns[search].id == MIPS_INS_LD ||
                       insns[search].id == MIPS_INS_ADDU ||
                       insns[search].id == MIPS_INS_ADD ||
                       insns[search].id == MIPS_INS_SUB ||
                       insns[search].id == MIPS_INS_SUBU) {
                break;
            }
        } else if (insns[search].id == MIPS_INS_JR &&
                   insns[search].operands[0].reg == MIPS_REG_RA)
        {
            // stop looking when previous `jr ra` is hit
            break;
        }
    }
}

static void pass1(void) {
    for (size_t i = 0; i < insns.size(); i++) {
        Insn& insn = insns[i];
        if (insn.id == MIPS_INS_BAL) {
            insn.id = MIPS_INS_JAL;
            insn.mnemonic = "jal";
        }
        if (insn.is_jump) {
            if (insn.id == MIPS_INS_JAL || insn.id == MIPS_INS_J) {
                uint32_t target  = (uint32_t)insn.operands[0].imm;
                label_addresses.insert(target);
                add_function(target);
            } else if (insn.id == MIPS_INS_JR) {
                // sltiu $at, $ty, z
                // sw    $reg, offset($sp)   (very seldom, one or more, usually in func entry)
                // lw    $gp, offset($sp)    (if PIC, and very seldom)
                // beqz  $at, .L
                // some other instruction    (not always)
                // lui   $at, %hi(jtbl)
                // sll   $tx, $ty, 2
                // addu  $at, $at, $tx
                // lw    $tx, %lo(jtbl)($at)
                // nop                       (code compiled with 5.3)
                // addu  $tx, $tx, $gp       (if PIC)
                // jr    $tx

                // IDO 7.1:
                //lw      at,offset(gp)
                //andi    t9,t8,0x3f
                //sll     t9,t9,0x2
                //addu    at,at,t9
                //lw      t9,offset(at)
                //addu    t9,t9,gp
                //jr      t9

                // IDO 5.3:
                //lw      at,offset(gp)
                //andi    t3,t2,0x3f
                //sll     t3,t3,0x2
                //addu    at,at,t3
                //something
                //lw      t3,offset(at)
                //something
                //addu    t3,t3,gp
                //jr      t3
                if (i >= 7 && rodata_section != NULL) {
                    bool is_pic = insns[i - 1].id == MIPS_INS_ADDU && insns[i - 1].operands[2].reg == MIPS_REG_GP;
                    bool has_nop = insns[i - is_pic - 1].id == MIPS_INS_NOP;
                    bool has_extra = insns[i - is_pic - has_nop - 5].id != MIPS_INS_BEQZ;
                    int lw = i - is_pic - has_nop - 1;
                    if (insns[lw].id != MIPS_INS_LW) {
                        --lw;
                    }
                    if (insns[lw].id == MIPS_INS_LW && insns[lw].linked_insn != -1) {
                        int sltiu_index = -1;
                        int andi_index = -1;
                        uint32_t addu_index = lw - 1;
                        uint32_t num_cases;
                        bool found = false;
                        bool and_variant = false;
                        int end = 14;
                        if (insns[addu_index].id != MIPS_INS_ADDU) {
                            --addu_index;
                        }
                        mips_reg index_reg = (mips_reg)insns[addu_index - 1].operands[1].reg;
                        if (insns[addu_index].id != MIPS_INS_ADDU) {
                            goto skip;
                        }
                        if (insns[addu_index - 1].id != MIPS_INS_SLL) {
                            goto skip;
                        }
                        if (insns[addu_index - 1].operands[0].reg != insn.operands[0].reg) {
                            goto skip;
                        }
                        for (int j = 3; j <= 4; j++) {
                            if (insns[lw - j].id == MIPS_INS_ANDI) {
                                andi_index = lw - j;
                                break;
                            }
                        }
                        if (i == 368393) {
                            // In copt
                            end = 18;
                        }
                        for (int j = 5; j <= end; j++) {
                            if (insns[lw - has_extra - j].id == MIPS_INS_SLTIU &&
                                insns[lw - has_extra - j].operands[0].reg == MIPS_REG_AT)
                            {
                                sltiu_index = j;
                                break;
                            }
                            if (insns[lw - has_extra - j].id == MIPS_INS_JR) {
                                // Prevent going into a previous switch
                                break;
                            }
                        }
                        if (sltiu_index != -1) {
                            andi_index = -1;
                        }
                        if (sltiu_index != -1 && insns[lw - has_extra - sltiu_index].id == MIPS_INS_SLTIU) {
                            num_cases = insns[lw - has_extra - sltiu_index].operands[2].imm;
                            found = true;
                        } else if (andi_index != -1) {
                            num_cases = insns[andi_index].operands[2].imm + 1;
                            found = true;
                            and_variant = true;
                        } else if (i == 219382) {
                            // Special hard case in copt where the initial sltiu is in another basic block
                            found = true;
                            num_cases = 13;
                        } else if (i == 370995) {
                            // Special hard case in copt where the initial sltiu is in another basic block
                            found = true;
                            num_cases = 12;
                        }
                        if (found) {
                            uint32_t jtbl_addr = insns[lw].linked_value;
                            if (is_pic) {
                                insns[i - 1].id = MIPS_INS_NOP;
                            }
                            //printf("jump table at %08x, size %u\n", jtbl_addr, num_cases);
                            insn.jtbl_addr = jtbl_addr;
                            insn.num_cases = num_cases;
                            insn.index_reg = index_reg;
                            insns[lw].id = MIPS_INS_NOP;
                            insns[addu_index].id = MIPS_INS_NOP;
                            insns[addu_index - 1].id = MIPS_INS_NOP;
                            if (!and_variant) {
                                insns[addu_index - 2].id = MIPS_INS_NOP;
                            }

                            if (jtbl_addr < rodata_vaddr || jtbl_addr + num_cases * sizeof(uint32_t) > rodata_vaddr + rodata_section_len) {
                                fprintf(stderr, "jump table outside rodata\n");
                                exit(EXIT_FAILURE);
                            }
                            for (uint32_t i = 0; i < num_cases; i++) {
                                uint32_t target_addr = read_u32_be(rodata_section + (jtbl_addr - rodata_vaddr) + i * sizeof(uint32_t));
                                target_addr += gp_value;
                                //printf("%08X\n", target_addr);
                                label_addresses.insert(target_addr);
                            }
                        }
                        skip:;
                    }
                }
            } else {
                for (int j = 0; j < insn.op_count; j++) {
                    if (insn.operands[j].type == MIPS_OP_IMM) {
                        uint32_t target  = (uint32_t)insn.operands[j].imm;
                        label_addresses.insert(target);
                    }
                }
            }
        }
        switch (insns[i].id) {
            // find floating point LI
            case MIPS_INS_MTC1:
            {
                unsigned int rt = insns[i].operands[0].reg;
                for (int s = i - 1; s >= 0; s--) {
                    if (insns[s].id == MIPS_INS_LUI && insns[s].operands[0].reg == rt) {
                        float f;
                        uint32_t lui_imm = (uint32_t)(insns[s].operands[1].imm << 16);
                        memcpy(&f, &lui_imm, sizeof(f));
                        insns[s].operands[1].imm <<= 16;
                        // link up the LUI with this instruction and the float
                        insns[s].linked_insn = i;
                        insns[s].linked_float = f;
                        // rewrite LUI instruction to be LI
                        insns[s].id = MIPS_INS_LI;
                        insns[s].mnemonic = "li";
                        break;
                    } else if (insns[s].id == MIPS_INS_LW ||
                                    insns[s].id == MIPS_INS_LD ||
                                    insns[s].id == MIPS_INS_LH ||
                                    insns[s].id == MIPS_INS_LHU ||
                                    insns[s].id == MIPS_INS_LB ||
                                    insns[s].id == MIPS_INS_LBU ||
                                    insns[s].id == MIPS_INS_ADDIU ||
                                    insns[s].id == MIPS_INS_ADD ||
                                    insns[s].id == MIPS_INS_SUB ||
                                    insns[s].id == MIPS_INS_SUBU) {
                        unsigned int rd = insns[s].operands[0].reg;
                        if (rt == rd) {
                            break;
                        }
                    } else if (insns[s].id == MIPS_INS_JR &&
                                    insns[s].operands[0].reg == MIPS_REG_RA) {
                        // stop looking when previous `jr ra` is hit
                        break;
                    }
                }
                break;
            }
            case MIPS_INS_SD:
            case MIPS_INS_SW:
            case MIPS_INS_SH:
            case MIPS_INS_SB:
            case MIPS_INS_LB:
            case MIPS_INS_LBU:
            case MIPS_INS_LD:
            case MIPS_INS_LDL:
            case MIPS_INS_LDR:
            case MIPS_INS_LH:
            case MIPS_INS_LHU:
            case MIPS_INS_LW:
            case MIPS_INS_LWU:
            case MIPS_INS_LDC1:
            case MIPS_INS_LWC1:
            case MIPS_INS_LWC2:
            case MIPS_INS_LWC3:
            case MIPS_INS_SWC1:
            case MIPS_INS_SWC2:
            case MIPS_INS_SWC3:
            {
                unsigned int mem_rs = insns[i].operands[1].mem.base;
                int mem_imm = (int)insns[i].operands[1].mem.disp;
                if (mem_rs == MIPS_REG_GP) {
                    unsigned int got_entry = (mem_imm + gp_value_adj) / sizeof(unsigned int);
                    if (got_entry >= got_locals.size()) {
                        got_entry -= got_locals.size();
                        if (got_entry < got_globals.size()) {
                            assert(insn.id == MIPS_INS_LW);
                            //printf("gp 0x%08x %s\n", mem_imm, got_globals[got_entry].name);
                            unsigned int dest_vaddr = got_globals[got_entry];
                            insns[i].is_global_got_memop = true;
                            insns[i].linked_value = dest_vaddr;
                            //insns[i].label = got_globals[got_entry].name;

                            //vaddr_references[dest_vaddr].insert(vaddr + i * 4);
                            //disasm_add_data_addr(state, dest_vaddr);
                            insns[i].id = MIPS_INS_LI;
                            insns[i].operands[1].imm = dest_vaddr;
                            char buf[32];
                            sprintf(buf, "$%s, 0x%x", cs_reg_name(handle, insn.operands[0].reg), dest_vaddr);
                            insns[i].op_str = buf;
                        }
                    }
                } else {
                    link_with_lui(i, mem_rs, mem_imm);
                }
                break;
            }
            case MIPS_INS_ADDIU:
            case MIPS_INS_ORI:
            {
                unsigned int rd = insns[i].operands[0].reg;
                unsigned int rs = insns[i].operands[1].reg;
                int64_t imm = insns[i].operands[2].imm;
                if (rs == MIPS_REG_ZERO) { // becomes LI
                    char buf[32];
                    insns[i].id = MIPS_INS_LI;
                    insns[i].operands[1].imm = imm;
                    insns[i].mnemonic = "li";
                    sprintf(buf, "$%s, %" PRIi64, cs_reg_name(handle, rd), imm);
                    insns[i].op_str = buf;
                } else if (/*rd == rs &&*/ rd != MIPS_REG_GP) { // only look for LUI if rd and rs are the same
                    link_with_lui(i, rs, (int)imm);
                }
                break;
            }
            case MIPS_INS_JALR:
            {
                unsigned int r = insn.operands[0].reg;
                if (r == MIPS_REG_T9) {
                    link_with_jalr(i);
                    if (insn.linked_insn != -1) {
                        char buf[32];
                        sprintf(buf, "0x%x", insn.linked_value);
                        insn.id = MIPS_INS_JAL;
                        insn.mnemonic = "jal";
                        insn.op_str = buf;
                        insn.operands[0].type = MIPS_OP_IMM;
                        insn.operands[0].imm = insn.linked_value;
                        label_addresses.insert(insn.linked_value);
                        add_function(insn.linked_value);
                    }
                }
                break;
            }
        }
        if (insn.id == MIPS_INS_ADDU && insn.operands[0].reg == MIPS_REG_GP && insn.operands[1].reg == MIPS_REG_GP && insn.operands[2].reg == MIPS_REG_T9 && i >= 2) {
            //state->function_entry_points.insert(vaddr + (i - 2) * 4);
            for (int j = i - 2; j <= i; j++) {
                insns[j].id = MIPS_INS_NOP;
                insns[j].mnemonic = "nop";
                insns[j].op_str = "";
            }
        }
    }
}

static uint32_t addr_to_i(uint32_t addr) {
    return (addr - text_vaddr) / 4;
}

static void pass2(void) {
    // Find returns in each function
    for (size_t i = 0; i < insns.size(); i++) {
        uint32_t addr = text_vaddr + i * 4;
        Insn& insn = insns[i];
        if (insn.id == MIPS_INS_JR && insn.operands[0].reg == MIPS_REG_RA) {
            auto it = find_function(addr);
            assert(it != functions.end());
            it->second.returns.push_back(addr + 4);
        }
        if (insn.is_global_got_memop && text_vaddr <= insn.operands[1].imm && insn.operands[1].imm < text_vaddr + text_section_len) {
            uint32_t faddr = insn.operands[1].imm;
            li_function_pointers.insert(faddr);
            functions[faddr].referenced_by_function_pointer = true;
#if INSPECT_FUNCTION_POINTERS
            fprintf(stderr, "li function pointer: 0x%x at 0x%x\n", faddr, addr);
#endif
        }
    }
    for (auto it = functions.begin(); it != functions.end(); ++it) {
        if (it->second.returns.size() == 0) {
            uint32_t i = addr_to_i(it->first);
            auto str_it = symbol_names.find(it->first);
            if (str_it != symbol_names.end() && str_it->second == "__start") {

            } else if (str_it != symbol_names.end() && str_it->second == "xmalloc") {
                // orig 5.3:
                /*
                496bf4:       3c1c0fb9        lui     gp,0xfb9
                496bf8:       279c366c        addiu   gp,gp,13932
                496bfc:       0399e021        addu    gp,gp,t9
                496c00:       27bdffd8        addiu   sp,sp,-40
                496c04:       8f858de8        lw      a1,-29208(gp)
                496c08:       10000006        b       496c24 <alloc_new+0x14>
                496c0c:       afbf0020        sw      ra,32(sp)
                */

                // jal   alloc_new
                //  lui  $a1, malloc_scb
                // jr    $ra
                //  nop
                uint32_t alloc_new_addr = text_vaddr + (i + 7) * 4;
                insns[i].id = MIPS_INS_JAL;
                insns[i].op_count = 1;
                insns[i].mnemonic = "jal";
                insns[i].op_str = "alloc_new";
                insns[i].operands[0].imm = alloc_new_addr;
                assert(symbol_names.count(alloc_new_addr) && symbol_names[alloc_new_addr] == "alloc_new");
                i++;
                if (insns[i + 5].id == MIPS_INS_LI) {
                    // 7.1
                    insns[i] = insns[i + 5];
                } else {
                    // 5.3
                    insns[i] = insns[i + 3];
                }
                i++;
                insns[i].id = MIPS_INS_JR;
                insns[i].op_count = 1;
                insns[i].mnemonic = "jr";
                insns[i].op_str = "$ra";
                insns[i].operands[0].reg = MIPS_REG_RA;
                it->second.returns.push_back(text_vaddr + i * 4 + 4);
                i++;
                for (uint32_t j = 0; j < 4; j++) {
                    insns[i].id = MIPS_INS_NOP;
                    insns[i].op_count = 0;
                    insns[i].mnemonic = "nop";
                    i++;
                }
            } else if (str_it != symbol_names.end() && str_it->second == "xfree") {
                // jal   alloc_dispose
                //  lui  $a1, malloc_scb
                // jr    $ra
                //  nop
                uint32_t alloc_dispose_addr = text_vaddr + (i + 4) * 4;
                if (symbol_names.count(alloc_dispose_addr + 4) && symbol_names[alloc_dispose_addr + 4] == "alloc_dispose") {
                    alloc_dispose_addr += 4;
                }
                insns[i].id = MIPS_INS_JAL;
                insns[i].op_count = 1;
                insns[i].mnemonic = "jal";
                insns[i].op_str = "alloc_dispose";
                insns[i].operands[0].imm = alloc_dispose_addr;
                assert(symbol_names.count(alloc_dispose_addr) && symbol_names[alloc_dispose_addr] == "alloc_dispose");
                i++;
                insns[i] = insns[i + 2];
                i++;
                insns[i].id = MIPS_INS_JR;
                insns[i].op_count = 1;
                insns[i].mnemonic = "jr";
                insns[i].op_str = "$ra";
                insns[i].operands[0].reg = MIPS_REG_RA;
                it->second.returns.push_back(text_vaddr + i * 4 + 4);
                i++;
                insns[i].id = MIPS_INS_NOP;
                insns[i].op_count = 0;
                insns[i].mnemonic = "nop";
            } else if (insns[i].id == MIPS_INS_LW && insns[i + 1].id == MIPS_INS_MOVE && insns[i + 2].id == MIPS_INS_JALR) {
                /*
                408f50:       8f998010        lw      t9,-32752(gp)
                408f54:       03e07821        move    t7,ra
                408f58:       0320f809        jalr    t9
                */
            } else if (it->first > mcount_addr) {
                fprintf(stderr, "no ret: 0x%x\n", it->first);
                abort();
            }
        }
        auto next = it;
        ++next;
        if (next == functions.end()) {
            it->second.end_addr = text_vaddr + text_section_len;
        } else {
            it->second.end_addr = next->first;
        }
    }
}

static void add_edge(uint32_t from, uint32_t to, bool function_entry = false, bool function_exit = false, bool extern_function = false, bool function_pointer = false) {
    Edge fe = Edge(), be = Edge();
    fe.i = to;
    be.i = from;
    fe.function_entry = function_entry;
    be.function_entry = function_entry;
    fe.function_exit = function_exit;
    be.function_exit = function_exit;
    fe.extern_function = extern_function;
    be.extern_function = extern_function;
    fe.function_pointer = function_pointer;
    be.function_pointer = function_pointer;
    insns[from].successors.push_back(fe);
    insns[to].predecessors.push_back(be);
}

static void pass3(void) {
    // Build graph
    for (size_t i = 0; i < insns.size(); i++) {
        uint32_t addr = text_vaddr + i * 4;
        Insn& insn = insns[i];
        if (insn.no_following_successor) {
            continue;
        }
        switch (insn.id) {
            case MIPS_INS_BEQ:
            case MIPS_INS_BGEZ:
            case MIPS_INS_BGTZ:
            case MIPS_INS_BLEZ:
            case MIPS_INS_BLTZ:
            case MIPS_INS_BNE:
            case MIPS_INS_BEQZ:
            case MIPS_INS_BNEZ:
            case MIPS_INS_BC1F:
            case MIPS_INS_BC1T:
                add_edge(i, i + 1);
                add_edge(i + 1, addr_to_i((uint32_t)insn.operands[insn.op_count - 1].imm));
                break;

            case MIPS_INS_BEQL:
            case MIPS_INS_BGEZL:
            case MIPS_INS_BGTZL:
            case MIPS_INS_BLEZL:
            case MIPS_INS_BLTZL:
            case MIPS_INS_BNEL:
            case MIPS_INS_BC1FL:
            case MIPS_INS_BC1TL:
                add_edge(i, i + 1);
                add_edge(i, i + 2);
                add_edge(i + 1, addr_to_i((uint32_t)insn.operands[insn.op_count - 1].imm));
                insns[i + 1].no_following_successor = true; // don't inspect delay slot
                break;

            case MIPS_INS_B:
            case MIPS_INS_J:
                add_edge(i, i + 1);
                add_edge(i + 1, addr_to_i((uint32_t)insn.operands[0].imm));
                insns[i + 1].no_following_successor = true; // don't inspect delay slot
                break;

            case MIPS_INS_JR: {
                add_edge(i, i + 1);
                if (insn.jtbl_addr != 0) {
                    uint32_t jtbl_pos = insn.jtbl_addr - rodata_vaddr;
                    assert(jtbl_pos < rodata_section_len && jtbl_pos + insn.num_cases * 4 <= rodata_section_len);
                    for (uint32_t j = 0; j < insn.num_cases; j++) {
                        uint32_t dest_addr = read_u32_be(rodata_section + jtbl_pos + j * 4) + gp_value;
                        add_edge(i + 1, addr_to_i(dest_addr));
                    }
                } else {
                    assert(insn.operands[0].reg == MIPS_REG_RA && "jump to address in register not supported");
                }
                insns[i + 1].no_following_successor = true; // don't inspect delay slot
                break;
            }

            case MIPS_INS_JAL: {
                add_edge(i, i + 1);
                uint32_t dest = (uint32_t)insn.operands[0].imm;
                if (dest > mcount_addr && dest >= text_vaddr && dest < text_vaddr + text_section_len) {
                    add_edge(i + 1, addr_to_i(dest), true);
                    auto it = functions.find(dest);
                    assert(it != functions.end());
                    for (uint32_t ret_instr : it->second.returns) {
                        add_edge(addr_to_i(ret_instr), i + 2, false, true);
                    }
                } else {
                    add_edge(i + 1, i + 2, false, false, true);
                }
                insns[i + 1].no_following_successor = true; // don't inspect delay slot
                break;
            }

            case MIPS_INS_JALR:
                // function pointer
                add_edge(i, i + 1);
                add_edge(i + 1, i + 2, false, false, false, true);
                insns[i + 1].no_following_successor = true; // don't inspect delay slot
                break;

            default:
                add_edge(i, i + 1);
                break;
        }
    }
}

static uint64_t map_reg(int32_t reg) {
    if (reg > MIPS_REG_31) {
        if (reg == MIPS_REG_HI) {
            reg = MIPS_REG_31 + 1;
        } else if (reg == MIPS_REG_LO) {
            reg = MIPS_REG_31 + 2;
        } else {
            return 0;
        }
    }
    return (uint64_t)1 << (reg - MIPS_REG_0 + 1);
}

static uint64_t temporary_regs(void) {
    return
        map_reg(MIPS_REG_T0) |
        map_reg(MIPS_REG_T1) |
        map_reg(MIPS_REG_T2) |
        map_reg(MIPS_REG_T3) |
        map_reg(MIPS_REG_T4) |
        map_reg(MIPS_REG_T5) |
        map_reg(MIPS_REG_T6) |
        map_reg(MIPS_REG_T7) |
        map_reg(MIPS_REG_T8) |
        map_reg(MIPS_REG_T9);
}

typedef enum {
    TYPE_NOP,
    TYPE_1S,
    TYPE_2S,
    TYPE_1D,
    TYPE_1D_1S,
    TYPE_1D_2S,
    TYPE_D_LO_HI_2S,
    TYPE_1S_POS1
} TYPE;
static TYPE insn_to_type(Insn& i) {
    switch (i.id) {
        case MIPS_INS_ADD:
        case MIPS_INS_ADDU:
            if (i.mnemonic != "add.s" && i.mnemonic != "add.d") {
                return TYPE_1D_2S;
            } else {
                return TYPE_NOP;
            }

        case MIPS_INS_ADDI:
        case MIPS_INS_ADDIU:
        case MIPS_INS_ANDI:
        case MIPS_INS_ORI:
        case MIPS_INS_LB:
        case MIPS_INS_LBU:
        case MIPS_INS_LH:
        case MIPS_INS_LHU:
        case MIPS_INS_LW:
        case MIPS_INS_LWL:
        //case MIPS_INS_LWR:
        case MIPS_INS_MOVE:
        case MIPS_INS_NEGU:
        case MIPS_INS_NOT:
        case MIPS_INS_SLL:
        case MIPS_INS_SLTI:
        case MIPS_INS_SLTIU:
        case MIPS_INS_SRA:
        case MIPS_INS_SRL:
        case MIPS_INS_XORI:
            return TYPE_1D_1S;

        case MIPS_INS_MFHI:
            i.operands[1].reg = MIPS_REG_HI;
            return TYPE_1D_1S;

        case MIPS_INS_MFLO:
            i.operands[1].reg = MIPS_REG_LO;
            return TYPE_1D_1S;

        case MIPS_INS_AND:
        case MIPS_INS_OR:
        case MIPS_INS_NOR:
        case MIPS_INS_SLLV:
        case MIPS_INS_SLT:
        case MIPS_INS_SLTU:
        case MIPS_INS_SRAV:
        case MIPS_INS_SRLV:
        case MIPS_INS_SUBU:
        case MIPS_INS_XOR:
            return TYPE_1D_2S;

        case MIPS_INS_CFC1:
        case MIPS_INS_MFC1:
        case MIPS_INS_LI:
        case MIPS_INS_LUI:
            return TYPE_1D;

        case MIPS_INS_CTC1:
        case MIPS_INS_BGEZ:
        case MIPS_INS_BGEZL:
        case MIPS_INS_BGTZ:
        case MIPS_INS_BGTZL:
        case MIPS_INS_BLEZ:
        case MIPS_INS_BLEZL:
        case MIPS_INS_BLTZ:
        case MIPS_INS_BLTZL:
        case MIPS_INS_BEQZ:
        case MIPS_INS_BNEZ:
        case MIPS_INS_MTC1:
            return TYPE_1S;

        case MIPS_INS_BEQ:
        case MIPS_INS_BEQL:
        case MIPS_INS_BNE:
        case MIPS_INS_BNEL:
        case MIPS_INS_SB:
        case MIPS_INS_SH:
        case MIPS_INS_SW:
        case MIPS_INS_SWL:
        //case MIPS_INS_SWR:
        case MIPS_INS_TNE:
        case MIPS_INS_TEQ:
        case MIPS_INS_TGE:
        case MIPS_INS_TGEU:
        case MIPS_INS_TLT:
            return TYPE_2S;

        case MIPS_INS_DIV:
            if (i.mnemonic != "div.s" && i.mnemonic != "div.d") {
                return TYPE_D_LO_HI_2S;
            } else {
                return TYPE_NOP;
            }

        case MIPS_INS_DIVU:
        case MIPS_INS_MULT:
        case MIPS_INS_MULTU:
            return TYPE_D_LO_HI_2S;

        case MIPS_INS_NEG:
            if (i.mnemonic != "neg.s" && i.mnemonic != "neg.d") {
                return TYPE_1D_1S;
            } else {
                return TYPE_NOP;
            }

        case MIPS_INS_JALR:
            return TYPE_1S;

        case MIPS_INS_JR:
            if (i.jtbl_addr != 0) {
                i.operands[0].reg = i.index_reg;
            }
            if (i.operands[0].reg == MIPS_REG_RA) {
                return TYPE_NOP;
            }
            return TYPE_1S;

        case MIPS_INS_LWC1:
        case MIPS_INS_LDC1:
        case MIPS_INS_SWC1:
        case MIPS_INS_SDC1:
            return TYPE_1S_POS1;

        default:
            return TYPE_NOP;
    }
}

static void pass4(void) {
    vector<uint32_t> q;
    uint64_t livein_func_start = 1U | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) | map_reg(MIPS_REG_SP) | map_reg(MIPS_REG_ZERO);

    q.push_back(main_addr);
    insns[addr_to_i(main_addr)].f_livein = livein_func_start;

    for (auto& it : data_function_pointers) {
        q.push_back(it.second);
        insns[addr_to_i(it.second)].f_livein = livein_func_start | map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3);
    }
    for (auto& addr : li_function_pointers) {
        q.push_back(addr);
        insns[addr_to_i(addr)].f_livein = livein_func_start | map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3);
    }

    while (!q.empty()) {
        uint32_t addr = q.back();
        q.pop_back();
        uint32_t idx = addr_to_i(addr);
        Insn& i = insns[idx];
        uint64_t live = i.f_livein | 1;
        switch (insn_to_type(i)) {
            case TYPE_1D:
                live |= map_reg(i.operands[0].reg);
                break;

            case TYPE_1D_1S:
                if (live & map_reg(i.operands[1].reg)) {
                    live |= map_reg(i.operands[0].reg);
                }
                break;

            case TYPE_1D_2S:
                if ((live & map_reg(i.operands[1].reg)) && (live & map_reg(i.operands[2].reg))) {
                    live |= map_reg(i.operands[0].reg);
                }
                break;

            case TYPE_D_LO_HI_2S:
                if ((live & map_reg(i.operands[0].reg)) && (live & map_reg(i.operands[1].reg))) {
                    live |= map_reg(MIPS_REG_LO);
                    live |= map_reg(MIPS_REG_HI);
                }
                break;
        }
        if ((i.f_liveout | live) == i.f_liveout) {
            // No new bits
            continue;
        }
        live |= i.f_liveout;
        i.f_liveout = live;

        bool function_entry = false;
        for (Edge& e : i.successors) {
            uint64_t new_live = live;
            if (e.function_exit) {
                new_live &= 1U | map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_V1) | map_reg(MIPS_REG_ZERO);
            } else if (e.function_entry) {
                new_live &= 1U | map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
                            map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_SP) | map_reg(MIPS_REG_ZERO);
                function_entry = true;
            } else if (e.extern_function) {
                string name;
                bool is_extern_function = false;
                size_t extern_function_id;
                auto it = symbol_names.find(insns[idx - 1].operands[0].imm);
                if (it != symbol_names.end()) {
                    name = it->second;
                    for (size_t i = 0; i < sizeof(extern_functions) / sizeof(extern_functions[0]); i++) {
                        if (name == extern_functions[i].name) {
                            is_extern_function = true;
                            extern_function_id = i;
                            break;
                        }
                    }
                    if (!is_extern_function) {
                        fprintf(stderr, "missing extern function: %s\n", name.c_str());
                    }
                }
                assert(is_extern_function);
                auto& fn = extern_functions[extern_function_id];
                char ret_type = fn.params[0];
                new_live &= ~(map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
                              map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_V1) | temporary_regs());
                switch (ret_type) {
                    case 'i':
                    case 'u':
                    case 'p':
                        new_live |= map_reg(MIPS_REG_V0);
                        break;
                    case 'f':
                        break;
                    case 'd':
                        break;
                    case 'v':
                        break;
                    case 'l':
                    case 'j':
                        new_live |= map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_V1);
                        break;
                }
            } else if (e.function_pointer) {
                new_live &= ~(map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
                              map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_V1) | temporary_regs());
                new_live |= map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_V1);
            }
            if ((insns[e.i].f_livein | new_live) != insns[e.i].f_livein) {
                insns[e.i].f_livein |= new_live;
                q.push_back(text_vaddr + e.i * 4);
            }
        }
        if (function_entry) {
            // add one edge that skips the function call, for callee-saved register liveness propagation
            live &= ~(map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
                      map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_V1) | temporary_regs());
            if ((insns[idx + 1].f_livein | live) != insns[idx + 1].f_livein) {
                insns[idx + 1].f_livein |= live;
                q.push_back(text_vaddr + (idx + 1) * 4);
            }
        }
    }
}

static void pass5(void) {
    vector<uint32_t> q;

    assert(functions.count(main_addr));

    q = functions[main_addr].returns;
    for (auto addr : q) {
        insns[addr_to_i(addr)].b_liveout = 1U | map_reg(MIPS_REG_V0);
    }
    for (auto& it : data_function_pointers) {
        for (auto addr : functions[it.second].returns) {
            q.push_back(addr);
            insns[addr_to_i(addr)].b_liveout = 1U | map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_V1);
        }
    }
    for (auto& func_addr : li_function_pointers) {
        for (auto addr : functions[func_addr].returns) {
            q.push_back(addr);
            insns[addr_to_i(addr)].b_liveout = 1U | map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_V1);
        }
    }
    for (size_t i = 0; i < insns.size(); i++) {
        if (insns[i].f_livein != 0) {
            // Instruction is reachable
            q.push_back(text_vaddr + i * 4);
        }
    }

    while (!q.empty()) {
        uint32_t addr = q.back();
        q.pop_back();
        uint32_t idx = addr_to_i(addr);
        Insn& i = insns[idx];
        uint64_t live = i.b_liveout | 1;
        switch (insn_to_type(i)) {
            case TYPE_1S:
                live |= map_reg(i.operands[0].reg);
                break;

            case TYPE_1S_POS1:
                live |= map_reg(i.operands[1].reg);
                break;

            case TYPE_2S:
                live |= map_reg(i.operands[0].reg);
                live |= map_reg(i.operands[1].reg);
                break;

            case TYPE_1D:
                live &= ~map_reg(i.operands[0].reg);
                break;

            case TYPE_1D_1S:
                if (live & map_reg(i.operands[0].reg)) {
                    live &= ~map_reg(i.operands[0].reg);
                    live |= map_reg(i.operands[1].reg);
                }
                break;

            case TYPE_1D_2S:
                if (live & map_reg(i.operands[0].reg)) {
                    live &= ~map_reg(i.operands[0].reg);
                    live |= map_reg(i.operands[1].reg);
                    live |= map_reg(i.operands[2].reg);
                }
                break;

            case TYPE_D_LO_HI_2S: {
                bool used = (live & map_reg(MIPS_REG_LO)) || (live & map_reg(MIPS_REG_HI));
                live &= ~map_reg(MIPS_REG_LO);
                live &= ~map_reg(MIPS_REG_HI);
                if (used) {
                    live |= map_reg(i.operands[0].reg);
                    live |= map_reg(i.operands[1].reg);
                }
                break;
            }
        }
        if ((i.b_livein | live) == i.b_livein) {
            // No new bits
            continue;
        }
        live |= i.b_livein;
        i.b_livein = live;

        bool function_exit = false;
        for (Edge& e : i.predecessors) {
            uint64_t new_live = live;
            if (e.function_exit) {
                new_live &= 1U | map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_V1);
                function_exit = true;
            } else if (e.function_entry) {
                new_live &= 1U | map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
                            map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_SP);
            } else if (e.extern_function) {
                string name;
                bool is_extern_function = false;
                size_t extern_function_id;
                auto it = symbol_names.find(insns[idx - 2].operands[0].imm);
                if (it != symbol_names.end()) {
                    name = it->second;
                    for (size_t i = 0; i < sizeof(extern_functions) / sizeof(extern_functions[0]); i++) {
                        if (name == extern_functions[i].name) {
                            is_extern_function = true;
                            extern_function_id = i;
                            break;
                        }
                    }
                }
                assert(is_extern_function);
                auto& fn = extern_functions[extern_function_id];
                uint64_t args = 1U;
                if (fn.flags & FLAG_VARARG) {
                    // Assume the worst, that all four registers are used
                    for (int j = 0; j < 4; j++) {
                        args |= map_reg(MIPS_REG_A0 + j);
                    }
                }
                int pos = 0;
                int pos_float = 0;
                bool only_floats_so_far = true;
                for (const char *p = fn.params + 1; *p != '\0'; ++p) {
                    switch (*p) {
                        case 'i':
                        case 'u':
                        case 'p':
                        case 't':
                            only_floats_so_far = false;
                            if (pos < 4) {
                                args |= map_reg(MIPS_REG_A0 + pos);
                            }
                            ++pos;
                            break;
                        case 'f':
                            if (only_floats_so_far && pos_float < 4) {
                                pos_float += 2;
                            } else if (pos < 4) {
                                args |= map_reg(MIPS_REG_A0 + pos);
                            }
                            ++pos;
                            break;
                        case 'd':
                            if (pos % 1 != 0) {
                                ++pos;
                            }
                            if (only_floats_so_far && pos_float < 4) {
                                pos_float += 2;
                            } else if (pos < 4) {
                                args |= map_reg(MIPS_REG_A0 + pos) | map_reg(MIPS_REG_A0 + pos + 1);
                            }
                            pos += 2;
                            break;
                        case 'l':
                        case 'j':
                            if (pos % 1 != 0) {
                                ++pos;
                            }
                            only_floats_so_far = false;
                            if (pos < 4) {
                                args |= map_reg(MIPS_REG_A0 + pos) | map_reg(MIPS_REG_A0 + pos + 1);
                            }
                            pos += 2;
                            break;
                    }
                }
                args |= map_reg(MIPS_REG_SP);
                new_live &= ~(map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
                              map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_V1) | temporary_regs());
                new_live |= args;
            } else if (e.function_pointer) {
                new_live &= ~(map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
                              map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_V1) | temporary_regs());
                new_live |= map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) | map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3);
            }
            if ((insns[e.i].b_liveout | new_live) != insns[e.i].b_liveout) {
                insns[e.i].b_liveout |= new_live;
                q.push_back(text_vaddr + e.i * 4);
            }
        }
        if (function_exit) {
            // add one edge that skips the function call, for callee-saved register liveness propagation
            live &= ~(map_reg(MIPS_REG_V0) | map_reg(MIPS_REG_A0) | map_reg(MIPS_REG_A1) |
                      map_reg(MIPS_REG_A2) | map_reg(MIPS_REG_A3) | map_reg(MIPS_REG_V1) | temporary_regs());
            if ((insns[idx - 1].b_liveout | live) != insns[idx - 1].b_liveout) {
                insns[idx - 1].b_liveout |= live;
                q.push_back(text_vaddr + (idx - 1) * 4);
            }
        }
    }
}

static void pass6(void) {
    for (auto& it : functions) {
        uint32_t addr = it.first;
        Function& f = it.second;
        for (uint32_t ret : f.returns) {
            Insn& i = insns[addr_to_i(ret)];
            if (i.f_liveout & i.b_liveout & map_reg(MIPS_REG_V1)) {
                f.nret = 2;
            } else if ((i.f_liveout & i.b_liveout & map_reg(MIPS_REG_V0)) && f.nret == 0) {
                f.nret = 1;
            }
        }
        Insn& insn = insns.at(addr_to_i(addr));
        for (int i = 0; i < 4; i++) {
            if (insn.f_livein & insn.b_livein & map_reg(MIPS_REG_A0 + i)) {
                f.nargs = 1 + i;
            }
        }
        f.v0_in = (insn.f_livein & insn.b_livein & map_reg(MIPS_REG_V0)) != 0 && !f.referenced_by_function_pointer;
    }
}

static void dump(void) {
    for (size_t i = 0; i < insns.size(); i++) {
        Insn& insn = insns[i];
        uint32_t vaddr = text_vaddr + i * 4;
        if (label_addresses.count(vaddr)) {
            if (symbol_names.count(vaddr)) {
                printf("L%08x: //%s\n", vaddr, symbol_names[vaddr].c_str());
            } else {
                printf("L%08x:\n", vaddr);
            }
        }
        printf("\t%s %s\n", insn.mnemonic.c_str(), insn.op_str.c_str());
    }
}

static const char *r(uint32_t reg) {
    return cs_reg_name(handle, reg);
}

static const char *wr(uint32_t reg) {
    static const char *regs[] = {
        "f0.w[0]", "f0.w[1]",
        "f2.w[0]", "f2.w[1]",
        "f4.w[0]", "f4.w[1]",
        "f6.w[0]", "f6.w[1]",
        "f8.w[0]", "f8.w[1]",
        "f10.w[0]", "f10.w[1]",
        "f12.w[0]", "f12.w[1]",
        "f14.w[0]", "f14.w[1]",
        "f16.w[0]", "f16.w[1]",
        "f18.w[0]", "f18.w[1]",
        "f20.w[0]", "f20.w[1]",
        "f22.w[0]", "f22.w[1]",
        "f24.w[0]", "f24.w[1]",
        "f26.w[0]", "f26.w[1]",
        "f28.w[0]", "f28.w[1]",
        "f30.w[0]", "f30.w[1]"
    };
    assert(reg >= MIPS_REG_F0 && reg <= MIPS_REG_F31);
    return regs[reg - MIPS_REG_F0];
}

static const char *fr(uint32_t reg) {
    static const char *regs[] = {
        "f0.f[0]", "f0.f[1]",
        "f2.f[0]", "f2.f[1]",
        "f4.f[0]", "f4.f[1]",
        "f6.f[0]", "f6.f[1]",
        "f8.f[0]", "f8.f[1]",
        "f10.f[0]", "f10.f[1]",
        "f12.f[0]", "f12.f[1]",
        "f14.f[0]", "f14.f[1]",
        "f16.f[0]", "f16.f[1]",
        "f18.f[0]", "f18.f[1]",
        "f20.f[0]", "f20.f[1]",
        "f22.f[0]", "f22.f[1]",
        "f24.f[0]", "f24.f[1]",
        "f26.f[0]", "f26.f[1]",
        "f28.f[0]", "f28.f[1]",
        "f30.f[0]", "f30.f[1]"
    };
    assert(reg >= MIPS_REG_F0 && reg <= MIPS_REG_F31);
    return regs[reg - MIPS_REG_F0];
}

static const char *dr(uint32_t reg) {
    static const char *regs[] = {
        "f0.d",
        "f2.d",
        "f4.d",
        "f6.d",
        "f8.d",
        "f10.d",
        "f12.d",
        "f14.d",
        "f16.d",
        "f18.d",
        "f20.d",
        "f22.d",
        "f24.d",
        "f26.d",
        "f28.d",
        "f30.d"
    };
    assert(reg >= MIPS_REG_F0 && reg <= MIPS_REG_F31 && (reg - MIPS_REG_F0) % 2 == 0);
    return regs[(reg - MIPS_REG_F0) / 2];
}

static void dump_instr(int i);

static void dump_cond_branch(int i, const char *lhs, const char *op, const char *rhs) {
    Insn& insn = insns[i];
    const char *cast1 = "";
    const char *cast2 = "";
    if (strcmp(op, "==") && strcmp(op, "!=")) {
        cast1 = "(int)";
        if (strcmp(rhs, "0")) {
            cast2 = "(int)";
        }
    }
    printf("if (%s%s %s %s%s) {", cast1, lhs, op, cast2, rhs);
    dump_instr(i + 1);
    printf("goto L%x;}\n", (uint32_t)insn.operands[insn.op_count - 1].imm);
}

static void dump_cond_branch_likely(int i, const char *lhs, const char *op, const char *rhs) {
    uint32_t target = text_vaddr + (i + 2) * 4;
    dump_cond_branch(i, lhs, op, rhs);
    if (!TRACE) {
        printf("else goto L%x;\n", target);
    } else {
        printf("else {printf(\"pc=0x%08x (ignored)\\n\"); goto L%x;}\n", text_vaddr + (i + 1) * 4, target);
    }
    label_addresses.insert(target);
}

static void dump_instr(int i) {
    const char *symbol_name = NULL;
    if (symbol_names.count(text_vaddr + i * 4) != 0) {
        symbol_name = symbol_names[text_vaddr + i * 4].c_str();
        printf("//%s:\n", symbol_name);
    }
    if (TRACE) {
        printf("++cnt; printf(\"pc=0x%08x%s%s\\n\"); ", text_vaddr + i * 4, symbol_name ? " " : "", symbol_name ? symbol_name : "");
    }
    Insn& insn = insns[i];
    if (!insn.is_jump && !conservative) {
        switch (insn_to_type(insn)) {
            case TYPE_1S:
                if (!(insn.f_livein & map_reg(insn.operands[0].reg))) {
                    printf("// fdead %llx ", (unsigned long long)insn.f_livein);
                }
                break;
            case TYPE_1S_POS1:
                if (!(insn.f_livein & map_reg(insn.operands[1].reg))) {
                    printf("// fdead %llx ", (unsigned long long)insn.f_livein);
                }
                break;
            case TYPE_2S:
                if (!(insn.f_livein & map_reg(insn.operands[0].reg)) || !(insn.f_livein & map_reg(insn.operands[1].reg))) {
                    printf("// fdead %llx ", (unsigned long long)insn.f_livein);
                }
                break;
            case TYPE_1D_2S:
                if (!(insn.f_livein & map_reg(insn.operands[2].reg))) {
                    printf("// fdead %llx ", (unsigned long long)insn.f_livein);
                    break;
                }
                // fallthrough
            case TYPE_1D_1S:
                if (!(insn.f_livein & map_reg(insn.operands[1].reg))) {
                    printf("// fdead %llx ", (unsigned long long)insn.f_livein);
                    break;
                }
                // fallthrough
            case TYPE_1D:
                if (!(insn.b_liveout & map_reg(insn.operands[0].reg))) {
                    printf("// bdead %llx ", (unsigned long long)insn.b_liveout);
                }
                break;
            case TYPE_D_LO_HI_2S:
                if (!(insn.f_livein & map_reg(insn.operands[0].reg)) || !(insn.f_livein & map_reg(insn.operands[1].reg))) {
                    printf("// fdead %llx ", (unsigned long long)insn.f_livein);
                    break;
                }
                if (!(insn.b_liveout & (map_reg(MIPS_REG_LO) | map_reg(MIPS_REG_HI)))) {
                    printf("// bdead %llx ", (unsigned long long)insn.b_liveout);
                }
                break;
        }
    }
    switch (insn.id) {
        case MIPS_INS_ADD:
        case MIPS_INS_ADDU:
            if (insn.mnemonic == "add.s") {
                printf("%s = %s + %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg), fr(insn.operands[2].reg));
            } else if (insn.mnemonic == "add.d") {
                printf("%s = %s + %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg), dr(insn.operands[2].reg));
            } else {
                printf("%s = %s + %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
            }
            break;
        case MIPS_INS_ADDI:
        case MIPS_INS_ADDIU:
            printf("%s = %s + 0x%x;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
            break;
        case MIPS_INS_AND:
            printf("%s = %s & %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
            break;
        case MIPS_INS_ANDI:
            printf("%s = %s & 0x%x;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
            break;
        case MIPS_INS_BEQ:
            dump_cond_branch(i, r(insn.operands[0].reg), "==", r(insn.operands[1].reg));
            break;
        case MIPS_INS_BEQL:
            dump_cond_branch_likely(i, r(insn.operands[0].reg), "==", r(insn.operands[1].reg));
            break;
        case MIPS_INS_BGEZ:
            dump_cond_branch(i, r(insn.operands[0].reg), ">=", "0");
            break;
        case MIPS_INS_BGEZL:
            dump_cond_branch_likely(i, r(insn.operands[0].reg), ">=", "0");
            break;
        case MIPS_INS_BGTZ:
            dump_cond_branch(i, r(insn.operands[0].reg), ">", "0");
            break;
        case MIPS_INS_BGTZL:
            dump_cond_branch_likely(i, r(insn.operands[0].reg), ">", "0");
            break;
        case MIPS_INS_BLEZ:
            dump_cond_branch(i, r(insn.operands[0].reg), "<=", "0");
            break;
        case MIPS_INS_BLEZL:
            dump_cond_branch_likely(i, r(insn.operands[0].reg), "<=", "0");
            break;
        case MIPS_INS_BLTZ:
            dump_cond_branch(i, r(insn.operands[0].reg), "<", "0");
            break;
        case MIPS_INS_BLTZL:
            dump_cond_branch_likely(i, r(insn.operands[0].reg), "<", "0");
            break;
        case MIPS_INS_BNE:
            dump_cond_branch(i, r(insn.operands[0].reg), "!=", r(insn.operands[1].reg));
            break;
        case MIPS_INS_BNEL:
            dump_cond_branch_likely(i, r(insn.operands[0].reg), "!=", insn.mnemonic == "bnezl" ? "0" : r(insn.operands[1].reg));
            break;
        case MIPS_INS_BREAK:
            printf("abort();\n");
            break;
        case MIPS_INS_BEQZ:
            dump_cond_branch(i, r(insn.operands[0].reg), "==", "0");
            break;
        /*case MIPS_INS_BEQZL:
            dump_cond_branch_likely(i, r(insn.operands[0].reg), "==", "0");
            break;*/
        case MIPS_INS_B:
            dump_instr(i + 1);
            printf("goto L%x;\n", (int32_t)insn.operands[0].imm);
            break;
        case MIPS_INS_BC1F:
        case MIPS_INS_BC1T:
            printf("if (%scf) {", insn.id == MIPS_INS_BC1F ? "!" : "");
            dump_instr(i + 1);
            printf("goto L%x;}\n", (int32_t)insn.operands[0].imm);
            break;
        case MIPS_INS_BC1FL:
        case MIPS_INS_BC1TL:
        {
            uint32_t target = text_vaddr + (i + 2) * 4;
            printf("if (%scf) {", insn.id == MIPS_INS_BC1FL ? "!" : "");
            dump_instr(i + 1);
            printf("goto L%x;}\n", (int32_t)insn.operands[0].imm);
            if (!TRACE) {
                printf("else goto L%x;\n", target);
            } else {
                printf("else {printf(\"pc=0x%08x (ignored)\\n\"); goto L%x;}\n", text_vaddr + (i + 1) * 4, target);
            }
            label_addresses.insert(target);
            break;
        }
        case MIPS_INS_BNEZ:
            dump_cond_branch(i, r(insn.operands[0].reg), "!=", "0");
            break;
        /*case MIPS_INS_BNEZL:
            dump_cond_branch_likely(i, r(insn.operands[0].reg), "!=", "0");
            break;*/
        case MIPS_INS_C:
            if (insn.mnemonic == "c.lt.s") {
                printf("cf = %s < %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg));
            } else if (insn.mnemonic == "c.le.s") {
                printf("cf = %s <= %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg));
            } else if (insn.mnemonic == "c.eq.s") {
                printf("cf = %s == %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg));
            } else if (insn.mnemonic == "c.lt.d") {
                printf("cf = %s < %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg));
            } else if (insn.mnemonic == "c.le.d") {
                printf("cf = %s <= %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg));
            } else if (insn.mnemonic == "c.eq.d") {
                printf("cf = %s == %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg));
            }
            break;
        case MIPS_INS_CVT:
            if (insn.mnemonic == "cvt.s.w") {
                printf("%s = (int)%s;\n", fr(insn.operands[0].reg), wr(insn.operands[1].reg));
            } else if (insn.mnemonic == "cvt.d.w") {
                printf("%s = (int)%s;\n", dr(insn.operands[0].reg), wr(insn.operands[1].reg));
            } else if (insn.mnemonic == "cvt.d.s") {
                printf("%s = %s;\n", dr(insn.operands[0].reg), fr(insn.operands[1].reg));
            } else if (insn.mnemonic == "cvt.s.d") {
                printf("%s = %s;\n", fr(insn.operands[0].reg), dr(insn.operands[1].reg));
            } else if (insn.mnemonic == "cvt.w.d") {
                printf("%s = cvt_w_d(%s);\n", wr(insn.operands[0].reg), dr(insn.operands[1].reg));
            } else if (insn.mnemonic == "cvt.w.s") {
                printf("%s = cvt_w_s(%s);\n", wr(insn.operands[0].reg), fr(insn.operands[1].reg));
            } else {
                goto unimplemented;
            }
            break;
        case MIPS_INS_CFC1:
            assert(insn.operands[1].reg == MIPS_REG_31);
            printf("%s = fcsr;\n", r(insn.operands[0].reg));
            break;
        case MIPS_INS_CTC1:
            assert(insn.operands[1].reg == MIPS_REG_31);
            printf("fcsr = %s;\n", r(insn.operands[0].reg));
            break;
        case MIPS_INS_DIV:
            if (insn.mnemonic == "div.s") {
                assert(insn.op_count == 3);
                printf("%s = %s / %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg), fr(insn.operands[2].reg));
            } else if (insn.mnemonic == "div.d") {
                assert(insn.op_count == 3);
                printf("%s = %s / %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg), dr(insn.operands[2].reg));
            } else {
                assert(insn.op_count == 2);
                printf("lo = (int)%s / (int)%s; ", r(insn.operands[0].reg), r(insn.operands[1].reg));
                printf("hi = (int)%s %% (int)%s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
            }
            break;
        case MIPS_INS_DIVU:
            assert(insn.op_count == 2);
            printf("lo = %s / %s; ", r(insn.operands[0].reg), r(insn.operands[1].reg));
            printf("hi = %s %% %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
            break;
        case MIPS_INS_MOV:
            if (insn.mnemonic == "mov.s") {
                printf("%s = %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg));
            } else if (insn.mnemonic == "mov.d") {
                printf("%s = %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg));
            } else {
                goto unimplemented;
            }
            break;
        case MIPS_INS_MUL:
            if (insn.mnemonic == "mul.s") {
                printf("%s = %s * %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg), fr(insn.operands[2].reg));
            } else if (insn.mnemonic == "mul.d") {
                printf("%s = %s * %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg), dr(insn.operands[2].reg));
            } else {
                goto unimplemented;
            }
            break;
        case MIPS_INS_NEG:
            if (insn.mnemonic == "neg.s") {
                printf("%s = -%s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg));
            } else if (insn.mnemonic == "neg.d") {
                printf("%s = -%s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg));
            } else {
                printf("%s = -%s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
            }
            break;
        case MIPS_INS_SUB:
            if (insn.mnemonic == "sub.s") {
                printf("%s = %s - %s;\n", fr(insn.operands[0].reg), fr(insn.operands[1].reg), fr(insn.operands[2].reg));
            } else if (insn.mnemonic == "sub.d") {
                printf("%s = %s - %s;\n", dr(insn.operands[0].reg), dr(insn.operands[1].reg), dr(insn.operands[2].reg));
            } else {
                goto unimplemented;
            }
            break;
        case MIPS_INS_J:
            dump_instr(i + 1);
            printf("goto L%x;\n", (uint32_t)insn.operands[0].imm);
            break;
        case MIPS_INS_JAL:
        {
            string name;
            bool is_extern_function = false;
            size_t extern_function_id;
            auto it = symbol_names.find(insn.operands[0].imm);
            if (it != symbol_names.end()) {
                name = it->second;
                for (size_t i = 0; i < sizeof(extern_functions) / sizeof(extern_functions[0]); i++) {
                    if (name == extern_functions[i].name) {
                        is_extern_function = true;
                        extern_function_id = i;
                        break;
                    }
                }
            }
            dump_instr(i + 1);
            if (is_extern_function) {
                auto& fn = extern_functions[extern_function_id];
                if (fn.flags & FLAG_VARARG) {
                    for (int j = 0; j < 4; j++) {
                        printf("MEM_U32(sp + %d) = %s;\n", j * 4, r(MIPS_REG_A0 + j));
                    }
                }
                char ret_type = fn.params[0];
                if (ret_type != 'v') {
                    switch (ret_type) {
                        case 'i':
                        case 'u':
                        case 'p':
                            printf("%s = ", r(MIPS_REG_V0));
                            break;
                        case 'f':
                            printf("%s = ", fr(MIPS_REG_F0));
                            break;
                        case 'd':
                            printf("%s = ", dr(MIPS_REG_F0));
                            break;
                        case 'l':
                        case 'j':
                            printf("temp64 = ");
                            break;
                    }
                }
                printf("wrapper_%s(", name.c_str());
                bool first = true;
                if (!(fn.flags & FLAG_NO_MEM)) {
                    printf("mem");
                    first = false;
                }
                int pos = 0;
                int pos_float = 0;
                bool only_floats_so_far = true;
                bool needs_sp = false;
                for (const char *p = fn.params + 1; *p != '\0'; ++p) {
                    if (!first) {
                        printf(", ");
                    }
                    first = false;
                    switch (*p) {
                        case 't':
                            printf("trampoline, ");
                            needs_sp = true;
                            // fallthrough
                        case 'i':
                        case 'u':
                        case 'p':
                            only_floats_so_far = false;
                            if (pos < 4) {
                                printf("%s", r(MIPS_REG_A0 + pos));
                            } else {
                                printf("MEM_%c32(sp + %d)", *p == 'i' ? 'S' : 'U', pos * 4);
                            }
                            ++pos;
                            break;
                        case 'f':
                            if (only_floats_so_far && pos_float < 4) {
                                printf("%s", fr(MIPS_REG_F12 + pos_float));
                                pos_float += 2;
                            } else if (pos < 4) {
                                printf("BITCAST_U32_TO_F32(%s)", r(MIPS_REG_A0 + pos));
                            } else {
                                printf("BITCAST_U32_TO_F32(MEM_U32(sp + %d))", pos * 4);
                            }
                            ++pos;
                            break;
                        case 'd':
                            if (pos % 1 != 0) {
                                ++pos;
                            }
                            if (only_floats_so_far && pos_float < 4) {
                                printf("%s", dr(MIPS_REG_F12 + pos_float));
                                pos_float += 2;
                            } else if (pos < 4) {
                                printf("BITCAST_U64_TO_F64(((uint64_t)%s << 32) | (uint64_t)%s)", r(MIPS_REG_A0 + pos), r(MIPS_REG_A0 + pos + 1));
                            } else {
                                printf("BITCAST_U64_TO_F64(((uint64_t)MEM_U32(sp + %d) << 32) | (uint64_t)MEM_U32(sp + %d))", pos * 4, (pos + 1) * 4);
                            }
                            pos += 2;
                            break;
                        case 'l':
                        case 'j':
                            if (pos % 1 != 0) {
                                ++pos;
                            }
                            only_floats_so_far = false;
                            if (*p == 'l') {
                                printf("(int64_t)");
                            }
                            if (pos < 4) {
                                printf("(((uint64_t)%s << 32) | (uint64_t)%s)", r(MIPS_REG_A0 + pos), r(MIPS_REG_A0 + pos + 1));
                            } else {
                                printf("(((uint64_t)MEM_U32(sp + %d) << 32) | (uint64_t)MEM_U32(sp + %d))", pos * 4, (pos + 1) * 4);
                            }
                            pos += 2;
                            break;
                    }
                }
                if ((fn.flags & FLAG_VARARG) || needs_sp) {
                    printf("%s%s", first ? "" : ", ", r(MIPS_REG_SP));
                }
                printf(");\n");
                if (ret_type == 'l' || ret_type == 'j') {
                    printf("%s = (uint32_t)(temp64 >> 32);\n", r(MIPS_REG_V0));
                    printf("%s = (uint32_t)temp64;\n", r(MIPS_REG_V1));
                }
                if (!name.empty()) {
                    //printf("printf(\"%s %%x\\n\", %s);\n", name.c_str(), r(MIPS_REG_A0));
                }
            } else {
                Function& f = functions.find((uint32_t)insn.operands[0].imm)->second;
                if (f.nret == 1) {
                    printf("v0 = ");
                } else if (f.nret == 2) {
                    printf("temp64 = ");
                }
                if (!name.empty()) {
                    //printf("printf(\"%s %%x\\n\", %s);\n", name.c_str(), r(MIPS_REG_A0));
                    printf("f_%s", name.c_str());
                } else {
                    printf("func_%x", (uint32_t)insn.operands[0].imm);
                }
                printf("(mem, sp");
                if (f.v0_in) {
                    printf(", %s", r(MIPS_REG_V0));
                }
                for (uint32_t i = 0; i < f.nargs; i++) {
                    printf(", %s", r(MIPS_REG_A0 + i));
                }
                printf(");\n");
                if (f.nret == 2) {
                    printf("%s = (uint32_t)(temp64 >> 32);\n", r(MIPS_REG_V0));
                    printf("%s = (uint32_t)temp64;\n", r(MIPS_REG_V1));
                }
            }
            printf("goto L%x;\n", text_vaddr + (i + 2) * 4);
            label_addresses.insert(text_vaddr + (i + 2) * 4);
            break;
        }
        case MIPS_INS_JALR:
            printf("fp_dest = %s;\n", r(insn.operands[0].reg));
            dump_instr(i + 1);
            printf("temp64 = trampoline(mem, sp, %s, %s, %s, %s, fp_dest);\n",
                r(MIPS_REG_A0), r(MIPS_REG_A1), r(MIPS_REG_A2), r(MIPS_REG_A3));
            printf("%s = (uint32_t)(temp64 >> 32);\n", r(MIPS_REG_V0));
            printf("%s = (uint32_t)temp64;\n", r(MIPS_REG_V1));
            printf("goto L%x;\n", text_vaddr + (i + 2) * 4);
            label_addresses.insert(text_vaddr + (i + 2) * 4);
            break;
        case MIPS_INS_JR:
            if (insn.jtbl_addr != 0) {
                uint32_t jtbl_pos = insn.jtbl_addr - rodata_vaddr;
                assert(jtbl_pos < rodata_section_len && jtbl_pos + insn.num_cases * 4 <= rodata_section_len);
#if 1
                printf(";static void *const Lswitch%x[] = {\n", insn.jtbl_addr);
                for (uint32_t i = 0; i < insn.num_cases; i++) {
                    uint32_t dest_addr = read_u32_be(rodata_section + jtbl_pos + i * 4) + gp_value;
                    printf("&&L%x,\n", dest_addr);
                    label_addresses.insert(dest_addr);
                }
                printf("};\n");
                printf("dest = Lswitch%x[%s];\n", insn.jtbl_addr, r(insn.index_reg));
                dump_instr(i + 1);
                printf("goto *dest;\n");
#else
                assert(insns[i + 1].id == MIPS_INS_NOP);
                printf("switch (%s) {\n", r(insn.index_reg));
                for (uint32_t i = 0; i < insn.num_cases; i++) {
                    uint32_t dest_addr = read_u32_be(rodata_section + jtbl_pos + i * 4) + gp_value;
                    printf("case %u: goto L%x;\n", i, dest_addr);
                    label_addresses.insert(dest_addr);
                }
                printf("}\n");
#endif
            } else {
                if (insn.operands[0].reg != MIPS_REG_RA) {
                    printf("UNSUPPORTED JR %s %s\n", insn.op_str.c_str(), r(insn.operands[0].reg));
                } else {
                    dump_instr(i + 1);
                    switch (find_function(text_vaddr + i * 4)->second.nret) {
                        case 0:
                            printf("return;\n");
                            break;
                        case 1:
                            printf("return v0;\n");
                            break;
                        case 2:
                            printf("return ((uint64_t)v0 << 32) | v1;\n");
                            break;
                    }
                }
            }
            break;
        case MIPS_INS_LB:
            printf("%s = MEM_S8(%s + %d);\n", r(insn.operands[0].reg), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
            break;
        case MIPS_INS_LBU:
            printf("%s = MEM_U8(%s + %d);\n", r(insn.operands[0].reg), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
            break;
        case MIPS_INS_LH:
            printf("%s = MEM_S16(%s + %d);\n", r(insn.operands[0].reg), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
            break;
        case MIPS_INS_LHU:
            printf("%s = MEM_U16(%s + %d);\n", r(insn.operands[0].reg), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
            break;
        case MIPS_INS_LUI:
            printf("%s = 0x%x;\n", r(insn.operands[0].reg), ((uint32_t)insn.operands[1].imm) << 16);
            break;
        case MIPS_INS_LW:
            printf("%s = MEM_U32(%s + %d);\n", r(insn.operands[0].reg), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
            break;
        case MIPS_INS_LWC1:
            printf("%s = MEM_U32(%s + %d);\n", wr(insn.operands[0].reg), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
            break;
        case MIPS_INS_LDC1:
            assert((insn.operands[0].reg - MIPS_REG_F0) % 2 == 0);
            printf("%s = MEM_U32(%s + %d);\n", wr(insn.operands[0].reg + 1), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
            printf("%s = MEM_U32(%s + %d + 4);\n", wr(insn.operands[0].reg), r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
            break;
        case MIPS_INS_LWL:
        {
            const char *reg = r(insn.operands[0].reg);
            printf("%s = %s + %d; ", reg, r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp);
            printf("%s = (MEM_U8(%s) << 24) | (MEM_U8(%s + 1) << 16) | (MEM_U8(%s + 2) << 8) | MEM_U8(%s + 3);\n", reg, reg, reg, reg, reg);
            break;
        }
        case MIPS_INS_LWR:
            printf("//lwr %s\n", insn.op_str.c_str());
            break;
        case MIPS_INS_LI:
            if (insn.is_global_got_memop && text_vaddr <= insn.operands[1].imm && insn.operands[1].imm < text_vaddr + text_section_len) {
                printf("%s = 0x%x; // function pointer\n", r(insn.operands[0].reg), (uint32_t)insn.operands[1].imm);
                label_addresses.insert((uint32_t)insn.operands[1].imm);
            } else {
                printf("%s = 0x%x;\n", r(insn.operands[0].reg), (uint32_t)insn.operands[1].imm);
            }
            break;
        case MIPS_INS_MFC1:
            printf("%s = %s;\n", r(insn.operands[0].reg), wr(insn.operands[1].reg));
            break;
        case MIPS_INS_MFHI:
            printf("%s = hi;\n", r(insn.operands[0].reg));
            break;
        case MIPS_INS_MFLO:
            printf("%s = lo;\n", r(insn.operands[0].reg));
            break;
        case MIPS_INS_MOVE:
            printf("%s = %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
            break;
        case MIPS_INS_MTC1:
            printf("%s = %s;\n", wr(insn.operands[1].reg), r(insn.operands[0].reg));
            break;
        case MIPS_INS_MULT:
            printf("lo = %s * %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
            printf("hi = (uint32_t)((int64_t)(int)%s * (int64_t)(int)%s >> 32);\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
            break;
        case MIPS_INS_MULTU:
            printf("lo = %s * %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
            printf("hi = (uint32_t)((uint64_t)%s * (uint64_t)%s >> 32);\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
            break;
        case MIPS_INS_NEGU:
            printf("%s = -%s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
            break;
        case MIPS_INS_NOR:
            printf("%s = ~(%s | %s);\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
            break;
        case MIPS_INS_NOT:
            printf("%s = ~%s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg));
            break;
        case MIPS_INS_OR:
            printf("%s = %s | %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
            break;
        case MIPS_INS_ORI:
            printf("%s = %s | 0x%x;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
            break;
        case MIPS_INS_SB:
            printf("MEM_U8(%s + %d) = (uint8_t)%s;\n", r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp, r(insn.operands[0].reg));
            break;
        case MIPS_INS_SH:
            printf("MEM_U16(%s + %d) = (uint16_t)%s;\n", r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp, r(insn.operands[0].reg));
            break;
        case MIPS_INS_SLL:
            printf("%s = %s << %d;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
            break;
        case MIPS_INS_SLLV:
            printf("%s = %s << (%s & 0x1f);\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
            break;
        case MIPS_INS_SLT:
            printf("%s = (int)%s < (int)%s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
            break;
        case MIPS_INS_SLTI:
            printf("%s = (int)%s < (int)0x%x;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
            break;
        case MIPS_INS_SLTIU:
            printf("%s = %s < 0x%x;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
            break;
        case MIPS_INS_SLTU:
            printf("%s = %s < %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
            break;
        case MIPS_INS_SRA:
            printf("%s = (int)%s >> %d;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
            break;
        case MIPS_INS_SRAV:
            printf("%s = (int)%s >> (%s & 0x1f);\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
            break;
        case MIPS_INS_SRL:
            printf("%s = %s >> %d;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
            break;
        case MIPS_INS_SRLV:
            printf("%s = %s >> (%s & 0x1f);\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
            break;
        case MIPS_INS_SUBU:
            printf("%s = %s - %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
            break;
        case MIPS_INS_SW:
            printf("MEM_U32(%s + %d) = %s;\n", r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp, r(insn.operands[0].reg));
            break;
        case MIPS_INS_SWC1:
            printf("MEM_U32(%s + %d) = %s;\n", r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp, wr(insn.operands[0].reg));
            break;
        case MIPS_INS_SDC1:
            assert((insn.operands[0].reg - MIPS_REG_F0) % 2 == 0);
            printf("MEM_U32(%s + %d) = %s;\n", r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp, wr(insn.operands[0].reg + 1));
            printf("MEM_U32(%s + %d + 4) = %s;\n", r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp, wr(insn.operands[0].reg));
            break;
        case MIPS_INS_SWL:
            for (int i = 0; i < 4; i++) {
                printf("MEM_U8(%s + %d + %d) = (uint8_t)(%s >> %d);\n", r(insn.operands[1].mem.base), (int)insn.operands[1].mem.disp, i, r(insn.operands[0].reg), (3 - i) * 8);
            }
            break;
        case MIPS_INS_SWR:
            printf("//swr %s\n", insn.op_str.c_str());
            break;
        case MIPS_INS_TRUNC:
            if (insn.mnemonic == "trunc.w.s") {
                printf("%s = (int)%s;\n", wr(insn.operands[0].reg), fr(insn.operands[1].reg));
            } else if (insn.mnemonic == "trunc.w.d") {
                printf("%s = (int)%s;\n", wr(insn.operands[0].reg), dr(insn.operands[1].reg));
            } else {
                goto unimplemented;
            }
            break;
        case MIPS_INS_XOR:
            printf("%s = %s ^ %s;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), r(insn.operands[2].reg));
            break;
        case MIPS_INS_XORI:
            printf("%s = %s ^ 0x%x;\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (uint32_t)insn.operands[2].imm);
            break;
        case MIPS_INS_TNE:
            printf("assert(%s == %s && \"tne %d\");\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (int)insn.operands[2].imm);
            break;
        case MIPS_INS_TEQ:
            printf("assert(%s != %s && \"teq %d\");\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (int)insn.operands[2].imm);
            break;
        case MIPS_INS_TGE:
            printf("assert((int)%s < (int)%s && \"tge %d\");\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (int)insn.operands[2].imm);
            break;
        case MIPS_INS_TGEU:
            printf("assert(%s < %s && \"tgeu %d\");\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (int)insn.operands[2].imm);
            break;
        case MIPS_INS_TLT:
            printf("assert((int)%s >= (int)%s && \"tlt %d\");\n", r(insn.operands[0].reg), r(insn.operands[1].reg), (int)insn.operands[2].imm);
            break;
        case MIPS_INS_NOP:
            printf("//nop;\n");
            break;
        default:
            unimplemented:
            printf("UNIMPLEMENTED %s %s\n", insn.mnemonic.c_str(), insn.op_str.c_str());
            break;
    }
}

static void inspect_data_function_pointers(vector<pair<uint32_t, uint32_t>>& ret, const uint8_t *section, uint32_t section_vaddr, uint32_t len) {
    for (uint32_t i = 0; i < len; i += 4) {
        uint32_t addr = read_u32_be(section + i);
        if (addr == 0x430b00 || addr == 0x433b00) {
            // in as1, not function pointers (normal integers)
            continue;
        }
        if (addr == 0x4a0000) {
            // in copt
            continue;
        }
        if (section_vaddr + i >= procedure_table_start && section_vaddr + i < procedure_table_start + procedure_table_len) {
            // some linking table with a "all" functions, in as1 5.3
            continue;
        }
        if (addr >= text_vaddr && addr < text_vaddr + text_section_len && addr % 4 == 0) {
#if INSPECT_FUNCTION_POINTERS
            fprintf(stderr, "assuming function pointer 0x%x at 0x%x\n", addr, section_vaddr + i);
#endif
            ret.push_back(make_pair(section_vaddr + i, addr));
            label_addresses.insert(addr);
            functions[addr].referenced_by_function_pointer = true;
        }
    }
}

static void dump_function_signature(Function& f, uint32_t vaddr) {
    printf("static ");
    switch (f.nret) {
        case 0:
            printf("void ");
            break;
        case 1:
            printf("uint32_t ");
            break;
        case 2:
            printf("uint64_t ");
            break;
    }
    auto name_it = symbol_names.find(vaddr);
    if (name_it != symbol_names.end()) {
        printf("f_%s", name_it->second.c_str());
    } else {
        printf("func_%x", vaddr);
    }
    printf("(uint8_t *mem, uint32_t sp");
    if (f.v0_in) {
        printf(", uint32_t %s", r(MIPS_REG_V0));
    }
    for (uint32_t i = 0; i < f.nargs; i++) {
        printf(", uint32_t %s", r(MIPS_REG_A0 + i));
    }
    printf(")");
}

static void dump_c(void) {
    map<string, uint32_t> symbol_names_inv;
    for (auto& it : symbol_names) {
        symbol_names_inv[it.second] = it.first;
    }

    uint32_t min_addr = ~0;
    uint32_t max_addr = 0;

    if (data_section_len > 0) {
        min_addr = MIN(min_addr, data_vaddr);
        max_addr = MAX(max_addr, data_vaddr + data_section_len);
    }
    if (rodata_section_len > 0) {
        min_addr = MIN(min_addr, rodata_vaddr);
        max_addr = MAX(max_addr, rodata_vaddr + rodata_section_len);
    }
    if (bss_section_len) {
        min_addr = MIN(min_addr, bss_vaddr);
        max_addr = MAX(max_addr, bss_vaddr + bss_section_len);
    }

    min_addr = min_addr & ~0xfff;
    max_addr = (max_addr + 0xfff) & ~0xfff;

    uint32_t stack_bottom = min_addr;
    min_addr -= 1 * 1024 * 1024; // 1 MB stack
    stack_bottom -= 16; // for main's stack frame

    printf("#include \"header.h\"\n");
    if (conservative) {
        printf("static uint32_t s0, s1, s2, s3, s4, s5, s6, s7, fp;\n");
    }
    printf("static const uint32_t rodata[] = {\n");
    for (size_t i = 0; i < rodata_section_len; i += 4) {
        printf("0x%x,%s", read_u32_be(rodata_section + i), i % 32 == 28 ? "\n" : "");
    }
    printf("};\n");
    printf("static const uint32_t data[] = {\n");
    for (size_t i = 0; i < data_section_len; i += 4) {
        printf("0x%x,%s", read_u32_be(data_section + i), i % 32 == 28 ? "\n" : "");
    }
    printf("};\n");

    /*if (!data_function_pointers.empty()) {
        printf("static const struct { uint32_t orig_addr; void *recompiled_addr; } data_function_pointers[] = {\n");
        for (auto item : data_function_pointers) {
            printf("{0x%x, &&L%x},\n", item.first, item.second);
        }
        printf("};\n");
    }*/

    if (TRACE) {
        printf("static unsigned long long int cnt = 0;\n");
    }

    for (auto& f_it : functions) {
        if (insns[addr_to_i(f_it.first)].f_livein != 0) {
            // Function is used
            dump_function_signature(f_it.second, f_it.first);
            printf(";\n");
        }
    }

    if (!data_function_pointers.empty() || !li_function_pointers.empty()) {
        printf("uint64_t trampoline(uint8_t *mem, uint32_t sp, uint32_t a0, uint32_t a1, uint32_t a2, uint32_t a3, uint32_t fp_dest) {\n");
        printf("switch (fp_dest) {\n");
        for (auto& it : functions) {
            Function& f = it.second;
            if (f.referenced_by_function_pointer) {
                printf("case 0x%x: ", it.first);
                if (f.nret == 1) {
                    printf("return (uint64_t)");
                } else if (f.nret == 2) {
                    printf("return ");
                }
                auto name_it = symbol_names.find(it.first);
                if (name_it != symbol_names.end()) {
                    printf("f_%s", name_it->second.c_str());
                } else {
                    printf("func_%x", it.first);
                }
                printf("(mem, sp");
                for (int i = 0; i < f.nargs; i++) {
                    printf(", a%d", i);
                }
                printf(")");
                if (f.nret == 1) {
                    printf(" << 32");
                }
                printf(";");
                if (f.nret == 0) {
                    printf(" return 0;");
                }
                printf("\n");
            }
        }
        printf("default: abort();");
        printf("}\n");
        printf("}\n");
    }

    printf("int run(uint8_t *mem, int argc, char *argv[]) {\n");
    printf("mmap_initial_data_range(mem, 0x%x, 0x%x);\n", min_addr, max_addr);

    printf("memcpy(mem + 0x%x, rodata, 0x%x);\n", rodata_vaddr, rodata_section_len);
    printf("memcpy(mem + 0x%x, data, 0x%x);\n", data_vaddr, data_section_len);

    /*if (!data_function_pointers.empty()) {
        if (!LABELS_64_BIT) {
            printf("for (int i = 0; i < %d; i++) MEM_U32(data_function_pointers[i].orig_addr) = (uint32_t)(uintptr_t)data_function_pointers[i].recompiled_addr;\n", (int)data_function_pointers.size());
        } else {
            printf("for (int i = 0; i < %d; i++) MEM_U32(data_function_pointers[i].orig_addr) = (uint32_t)((uintptr_t)data_function_pointers[i].recompiled_addr - (uintptr_t)&&Loffset);\n", (int)data_function_pointers.size());
        }
    }*/

    printf("MEM_S32(0x%x) = argc;\n", symbol_names_inv.at("__Argc"));
    printf("MEM_S32(0x%x) = argc;\n", stack_bottom);
    printf("uint32_t al = argc * 4; for (int i = 0; i < argc; i++) al += strlen(argv[i]) + 1;\n");
    printf("uint32_t arg_addr = wrapper_malloc(mem, al);\n");
    printf("MEM_U32(0x%x) = arg_addr;\n", symbol_names_inv.at("__Argv"));
    printf("MEM_U32(0x%x) = arg_addr;\n", stack_bottom + 4);
    printf("uint32_t arg_strpos = arg_addr + argc * 4;\n");
    printf("for (int i = 0; i < argc; i++) {MEM_U32(arg_addr + i * 4) = arg_strpos; uint32_t p = 0; do { MEM_S8(arg_strpos) = argv[i][p]; ++arg_strpos; } while (argv[i][p++] != '\\0');}\n");

    printf("setup_libc_data(mem);\n");

    //printf("gp = 0x%x;\n", gp_value); // only to recreate the outcome when ugen reads uninitialized stack memory

    printf("int ret = f_main(mem, 0x%x", stack_bottom);
    Function& main_func = functions[main_addr];
    if (main_func.nargs >= 1) {
        printf(", argc");
    }
    if (main_func.nargs >= 2) {
        printf(", arg_addr");
    }
    printf(");\n");
    if (TRACE) {
        printf("end: fprintf(stderr, \"cnt: %%llu\\n\", cnt);\n");
    }
    printf("return ret;\n");
    printf("}\n");

    for (auto& f_it : functions) {
        Function& f = f_it.second;
        uint32_t start_addr = f_it.first;
        uint32_t end_addr = f.end_addr;

        if (insns[addr_to_i(start_addr)].f_livein == 0) {
            // Non-used function, skip
            continue;
        }

        printf("\n");
        dump_function_signature(f, start_addr);
        printf(" {\n");
        printf("const uint32_t zero = 0;\n");
        if (!conservative) {
            printf("uint32_t at = 0, v1 = 0, t0 = 0, t1 = 0, t2 = 0,\n");
            printf("t3 = 0, t4 = 0, t5 = 0, t6 = 0, t7 = 0, s0 = 0, s1 = 0, s2 = 0, s3 = 0, s4 = 0, s5 = 0,\n");
            printf("s6 = 0, s7 = 0, t8 = 0, t9 = 0, gp = 0, fp = 0, s8 = 0, ra = 0;\n");
        } else {
            printf("uint32_t at = 0, v1 = 0, t0 = 0, t1 = 0, t2 = 0,\n");
            printf("t3 = 0, t4 = 0, t5 = 0, t6 = 0, t7 = 0, t8 = 0, t9 = 0, gp = 0x10000, ra = 0x10000;\n");
        }
        printf("uint32_t lo = 0, hi = 0;\n");
        printf("int cf = 0;\n");
        printf("uint64_t temp64;\n");
        printf("uint32_t fp_dest;\n");
        printf("void *dest;\n");
        if (!f.v0_in) {
            printf("uint32_t v0 = 0;\n");
        }
        for (uint32_t j = f.nargs; j < 4; j++) {
            printf("uint32_t %s = 0;\n", r(MIPS_REG_A0 + j));
        }

        for (size_t i = addr_to_i(start_addr), end_i = addr_to_i(end_addr); i < end_i; i++) {
            Insn& insn = insns[i];
            uint32_t vaddr = text_vaddr + i * 4;
            if (label_addresses.count(vaddr)) {
                printf("L%x:\n", vaddr);
            }
            dump_instr(i);
        }

        printf("}\n");
    }
    /*for (size_t i = 0; i < insns.size(); i++) {
        Insn& insn = insns[i];
        uint32_t vaddr = text_vaddr + i * 4;
        auto fn_it = functions.find(vaddr);
        if (fn_it != functions.end()) {
            Function& f = fn_it->second;
            printf("}\n\n");
            switch (f.nret) {
                case 0:
                    printf("void ");
                    break;
                case 1:
                    printf("uint32_t ");
                    break;
                case 2:
                    printf("uint64_t ");
                    break;
            }
            auto name_it = symbol_names.find(vaddr);
            if (name_it != symbol_names.end()) {
                printf("%s", name_it->second.c_str());
            } else {
                printf("func_%x", vaddr);
            }
            printf("(uint8_t *mem, uint32_t sp");
            if (f.v0_in) {
                printf(", uint32_t %s", r(MIPS_REG_V0));
            }
            for (uint32_t i = 0; i < f.nargs; i++) {
                printf(", uint32_t %s", r(MIPS_REG_A0 + i));
            }
            printf(") {\n");
            printf("const uint32_t zero = 0;\n");
            printf("uint32_t at = 0, v1 = 0, t0 = 0, t1 = 0, t2 = 0,\n");
            printf("t3 = 0, t4 = 0, t5 = 0, t6 = 0, t7 = 0, s0 = 0, s1 = 0, s2 = 0, s3 = 0, s4 = 0, s5 = 0,\n");
            printf("s6 = 0, s7 = 0, t8 = 0, t9 = 0, gp = 0, fp = 0, s8 = 0, ra = 0;\n");
            printf("uint32_t lo = 0, hi = 0;\n");
            printf("int cf = 0;\n");
            if (!f.v0_in) {
                printf("uint32_t v0 = 0;\n");
            }
            for (uint32_t j = f.nargs; j < 4; j++) {
                printf("uint32_t %s = 0;\n", r(MIPS_REG_A0 + j));
            }
        }
        if (label_addresses.count(vaddr)) {
            printf("L%x:\n", vaddr);
        }
        dump_instr(i);
    }*/
}

static void parse_elf(const uint8_t *data, size_t file_len) {
    Elf32_Ehdr *ehdr;
    Elf32_Shdr *shdr, *str_shdr, *sym_shdr = NULL, *dynsym_shdr, *dynamic_shdr, *reginfo_shdr, *got_shdr, *sym_strtab, *sym_dynstr;
    int text_section_index = -1;
    int symtab_section_index = -1;
    int dynsym_section_index = -1;
    int reginfo_section_index = -1;
    int dynamic_section_index = -1;
    int got_section_index = -1;
    int rodata_section_index = -1;
    int data_section_index = -1;
    int bss_section_index = -1;
    uint32_t text_offset = 0;
    uint32_t vaddr_adj = 0;

    if (file_len < 4 || data[0] != 0x7f || data[1] != 'E' || data[2] != 'L' || data[3] != 'F') {
        fprintf(stderr, "Not an ELF file.\n");
        exit(EXIT_FAILURE);
    }

    ehdr = (Elf32_Ehdr *) data;
    if (ehdr->e_ident[EI_DATA] != 2 || u16be(ehdr->e_machine) != 8) {
        fprintf(stderr, "Not big-endian MIPS.\n");
        exit(EXIT_FAILURE);
    }

    if (u16be(ehdr->e_shstrndx) == 0) {
        // (We could look at program headers instead in this case.)
        fprintf(stderr, "Missing section headers; stripped binaries are not yet supported.\n");
        exit(EXIT_FAILURE);
    }

#define SECTION(index) (Elf32_Shdr *)(data + u32be(ehdr->e_shoff) + (index) * u16be(ehdr->e_shentsize))
#define STR(strtab, offset) (const char *)(data + u32be(strtab->sh_offset) + offset)

    str_shdr = SECTION(u16be(ehdr->e_shstrndx));
    for (int i = 0; i < u16be(ehdr->e_shnum); i++) {
        shdr = SECTION(i);
        const char *name = STR(str_shdr, u32be(shdr->sh_name));
        if (strcmp(name, ".text") == 0) {
            text_offset = u32be(shdr->sh_offset);
            text_vaddr = u32be(shdr->sh_addr);
            vaddr_adj = text_vaddr - u32be(shdr->sh_addr);
            text_section_len = u32be(shdr->sh_size);
            text_section = data + text_offset;
            text_section_index = i;
        }
        if (u32be(shdr->sh_type) == SHT_SYMTAB) {
            symtab_section_index = i;
        }
        if (u32be(shdr->sh_type) == SHT_DYNSYM) {
            dynsym_section_index = i;
        }
        if (u32be(shdr->sh_type) == SHT_MIPS_REGINFO) {
            reginfo_section_index = i;
        }
        if (u32be(shdr->sh_type) == SHT_DYNAMIC) {
            dynamic_section_index = i;
        }
        if (strcmp(name, ".got") == 0) {
            got_section_index = i;
        }
        if (strcmp(name, ".rodata") == 0) {
            rodata_section_index = i;
        }
        if (strcmp(name, ".data") == 0) {
            data_section_index = i;
        }
        if (strcmp(name, ".bss") == 0) {
            bss_section_index = i;
        }
    }

    if (text_section_index == -1) {
        fprintf(stderr, "Missing .text section.\n");
        exit(EXIT_FAILURE);
    }

    if (symtab_section_index == -1 && dynsym_section_index == -1) {
        fprintf(stderr, "Missing .symtab or .dynsym section.\n");
        exit(EXIT_FAILURE);
    }

    if (dynsym_section_index != -1) {
        if (reginfo_section_index == -1) {
            fprintf(stderr, "Missing .reginfo section.\n");
            exit(EXIT_FAILURE);
        }
        if (dynamic_section_index == -1) {
            fprintf(stderr, "Missing .dynamic section.\n");
            exit(EXIT_FAILURE);
        }
        if (got_section_index == -1) {
            fprintf(stderr, "Missing .got section.\n");
            exit(EXIT_FAILURE);
        }
    }

    if (rodata_section_index != -1) {
        shdr = SECTION(rodata_section_index);
        uint32_t size = u32be(shdr->sh_size);
        rodata_section = data + u32be(shdr->sh_offset);
        rodata_section_len = size;
        rodata_vaddr = u32be(shdr->sh_addr);
    }

    if (data_section_index != -1) {
        shdr = SECTION(data_section_index);
        uint32_t size = u32be(shdr->sh_size);
        data_section = data + u32be(shdr->sh_offset);
        data_section_len = size;
        data_vaddr = u32be(shdr->sh_addr);
    }

    if (bss_section_index != -1) {
        shdr = SECTION(bss_section_index);
        uint32_t size = u32be(shdr->sh_size);
        bss_section_len = size;
        bss_vaddr = u32be(shdr->sh_addr);
    }


    // add symbols
    if (symtab_section_index != -1) {
        sym_shdr = SECTION(symtab_section_index);
        sym_strtab = SECTION(u32be(sym_shdr->sh_link));
        assert(0 && ".symtab not supported - use a program with .dynsym instead");

        assert(u32be(sym_shdr->sh_entsize) == sizeof(Elf32_Sym));
        for (uint32_t i = 0; i < u32be(sym_shdr->sh_size); i += sizeof(Elf32_Sym)) {
            Elf32_Sym *sym = (Elf32_Sym *)(data + u32be(sym_shdr->sh_offset) + i);
            const char *name = STR(sym_strtab, u32be(sym->st_name));
            uint32_t addr = u32be(sym->st_value);
            if (u16be(sym->st_shndx) != text_section_index || name[0] == '.') {
                continue;
            }
            addr += vaddr_adj;
            //disasm_label_add(state, name, addr, u32be(sym->st_size), true);
        }
    }

    if (dynsym_section_index != -1) {
        dynsym_shdr = SECTION(dynsym_section_index);
        sym_dynstr = SECTION(u32be(dynsym_shdr->sh_link));
        reginfo_shdr = SECTION(reginfo_section_index);
        dynamic_shdr = SECTION(dynamic_section_index);
        got_shdr = SECTION(got_section_index);

        Elf32_RegInfo *reg_info = (Elf32_RegInfo *)(data + u32be(reginfo_shdr->sh_offset));
        uint32_t gp_base = u32be(reg_info->ri_gp_value); // gp should have this value through the program run
        uint32_t got_start = 0;
        uint32_t local_got_no = 0;
        uint32_t first_got_sym = 0;
        uint32_t dynsym_no = 0; // section size can't be used due to alignment 16 padding

        assert(u32be(dynamic_shdr->sh_entsize) == sizeof(Elf32_Dyn));
        for (uint32_t i = 0; i < u32be(dynamic_shdr->sh_size); i += sizeof(Elf32_Dyn)) {
            Elf32_Dyn *dyn = (Elf32_Dyn *)(data + u32be(dynamic_shdr->sh_offset) + i);
            if (u32be(dyn->d_tag) == DT_PLTGOT) {
                got_start = u32be(dyn->d_un.d_ptr);
            }
            if (u32be(dyn->d_tag) == DT_MIPS_LOCAL_GOTNO) {
                local_got_no = u32be(dyn->d_un.d_val);
            }
            if (u32be(dyn->d_tag) == DT_MIPS_GOTSYM) {
                first_got_sym = u32be(dyn->d_un.d_val);
            }
            if (u32be(dyn->d_tag) == DT_MIPS_SYMTABNO) {
                dynsym_no = u32be(dyn->d_un.d_val);
            }
        }

        assert(got_start != 0);

        // value to add to asm gp offset, for example 32752, if -32752(gp) refers to the first entry in got.
        uint32_t gp_adj = gp_base - got_start;
        assert(gp_adj < 0x10000);

        assert(u32be(dynsym_shdr->sh_entsize) == sizeof(Elf32_Sym));
        uint32_t global_got_no = dynsym_no - first_got_sym;
        //global_got_entry *global_entries = (global_got_entry *)calloc(global_got_no, sizeof(global_got_entry));
        got_globals.resize(global_got_no);

        uint32_t common_start = ~0U;
        vector<string> common_order;

        for (uint32_t i = 0; i < dynsym_no; i++) {
            Elf32_Sym *sym = (Elf32_Sym *)(data + u32be(dynsym_shdr->sh_offset) + i * sizeof(Elf32_Sym));
            const char *name = STR(sym_dynstr, u32be(sym->st_name));
            uint32_t addr = u32be(sym->st_value);
            addr += vaddr_adj;
            uint8_t type = ELF32_ST_TYPE(sym->st_info);
            if (!strcmp(name, "_procedure_table")) {
                procedure_table_start = addr;
            } else if (!strcmp(name, "_procedure_table_size")) {
                procedure_table_len = 40 * u32be(sym->st_value);
            }
            if ((u16be(sym->st_shndx) == SHN_MIPS_TEXT && type == STT_FUNC) ||
                 (type == STT_OBJECT && (u16be(sym->st_shndx) == SHN_MIPS_ACOMMON || u16be(sym->st_shndx) == SHN_MIPS_DATA)))
            {
                //disasm_label_add(state, name, addr, u32be(sym->st_size), true);
                if (type == STT_OBJECT) {
                }
                if (u16be(sym->st_shndx) == SHN_MIPS_ACOMMON) {
                    if (addr < common_start) {
                        common_start = addr;
                    }
                    common_order.push_back(name);
                }
                if (type == STT_FUNC) {
                    add_function(addr);
                    if (strcmp(name, "main") == 0) {
                        main_addr = addr;
                    }
                    if (strcmp(name, "_mcount") == 0) {
                        mcount_addr = addr;
                    }
                    symbol_names[addr] = name;
                }
            }
            if (i >= first_got_sym) {
                uint32_t got_value = u32be(*(uint32_t *)(data + u32be(got_shdr->sh_offset) + (local_got_no + (i - first_got_sym)) * sizeof(uint32_t)));
                if (u16be(sym->st_shndx) == SHN_MIPS_TEXT && type == STT_FUNC) {
                    //got_globals[i - first_got_sym] = got_value;
                    //label_addresses.insert(got_value);
                    got_globals[i - first_got_sym] = addr; // to include the 3 instr gp header thing
                    label_addresses.insert(addr);
                } else if (type == STT_OBJECT && (u16be(sym->st_shndx) == SHN_UNDEF || u16be(sym->st_shndx) == SHN_COMMON)) {
                    // symbol defined externally (for example in libc)
                    got_globals[i - first_got_sym] = got_value;
                } else {
                    got_globals[i - first_got_sym] = addr;
                }
                symbol_names[got_globals[i - first_got_sym]] = name;
            }
        }

        uint32_t *local_entries = (uint32_t *)calloc(local_got_no, sizeof(uint32_t));
        got_locals.resize(local_got_no);
        for (uint32_t i = 0; i < local_got_no; i++) {
            uint32_t *entry = (uint32_t *)(data + u32be(got_shdr->sh_offset) + i * sizeof(uint32_t));
            got_locals[i] = u32be(*entry);
        }

        gp_value = gp_base;
        gp_value_adj = gp_adj;
        //disasm_got_entries_set(state, gp_base, gp_adj, local_entries, local_got_no, global_entries, global_got_no);

        //out_range.common_start = common_start;
        //out_range.common_order.swap(common_order);
    }

    // add relocations
    for (int i = 0; i < u16be(ehdr->e_shnum); i++) {
        Elf32_Rel *prevHi = NULL;
        shdr = SECTION(i);
        if (u32be(shdr->sh_type) != SHT_REL || u32be(shdr->sh_info) != (uint32_t) text_section_index)
            continue;

        if (sym_shdr == NULL) {
            fprintf(stderr, "Relocations without .symtab section\n");
            exit(EXIT_FAILURE);
        }

        assert(u32be(shdr->sh_link) == (uint32_t) symtab_section_index);
        assert(u32be(shdr->sh_entsize) == sizeof(Elf32_Rel));
        for (uint32_t i = 0; i < u32be(shdr->sh_size); i += sizeof(Elf32_Rel)) {
            Elf32_Rel *rel = (Elf32_Rel *)(data + u32be(shdr->sh_offset) + i);
            uint32_t offset = text_offset + u32be(rel->r_offset);
            uint32_t symIndex = ELF32_R_SYM(u32be(rel->r_info));
            uint32_t rtype = ELF32_R_TYPE(u32be(rel->r_info));
            const char *symName = "0";
            if (symIndex != STN_UNDEF) {
                Elf32_Sym *sym = (Elf32_Sym *)(data + u32be(sym_shdr->sh_offset) + symIndex * sizeof(Elf32_Sym));
                symName = STR(sym_strtab, u32be(sym->st_name));
            }

            if (rtype == R_MIPS_HI16) {
                if (prevHi != NULL) {
                    fprintf(stderr, "Consecutive R_MIPS_HI16.\n");
                    exit(EXIT_FAILURE);
                }
                prevHi = rel;
                continue;
            }
            if (rtype == R_MIPS_LO16) {
                int32_t addend = (int16_t)((data[offset + 2] << 8) + data[offset + 3]);
                if (prevHi != NULL) {
                    uint32_t offset2 = text_offset + u32be(prevHi->r_offset);
                    addend += (uint32_t)((data[offset2 + 2] << 8) + data[offset2 + 3]) << 16;
                    //add_reloc(state, offset2, symName, addend, out_range.vaddr);
                }
                prevHi = NULL;
                //add_reloc(state, offset, symName, addend, out_range.vaddr);
            }
            else if (rtype == R_MIPS_26) {
                int32_t addend = (u32be(*(uint32_t*)(data + offset)) & ((1 << 26) - 1)) << 2;
                if (addend >= (1 << 27)) {
                    addend -= 1 << 28;
                }
                //add_reloc(state, offset, symName, addend, out_range.vaddr);
            }
            else {
                fprintf(stderr, "Bad relocation type %d.\n", rtype);
                exit(EXIT_FAILURE);
            }
        }
        if (prevHi != NULL) {
            fprintf(stderr, "R_MIPS_HI16 without matching R_MIPS_LO16.\n");
            exit(EXIT_FAILURE);
        }
    }
}
#undef SECTION
#undef STR

size_t read_file(const char *file_name, uint8_t **data) {
    FILE *in;
    uint8_t *in_buf = NULL;
    long file_size;
    long bytes_read;
    in = fopen(file_name, "rb");
    assert(in != nullptr);

    // allocate buffer to read from offset to end of file
    fseek(in, 0, SEEK_END);
    file_size = ftell(in);
    assert(file_size != -1L);

    in_buf = (uint8_t *)malloc(file_size);
    fseek(in, 0, SEEK_SET);

    // read bytes
    bytes_read = fread(in_buf, 1, file_size, in);
    assert(bytes_read == file_size);

    fclose(in);
    *data = in_buf;
    return bytes_read;
}

int main(int argc, char *argv[]) {
    const char *filename = argv[1];
    if (strcmp(filename, "--conservative") == 0) {
        conservative = true;
        filename = argv[2];
    }

    uint8_t *data;
    size_t len = read_file(filename, &data);
    parse_elf(data, len);
    assert(cs_open(CS_ARCH_MIPS, (cs_mode)(CS_MODE_MIPS64 | CS_MODE_BIG_ENDIAN), &handle) == CS_ERR_OK);
    cs_option(handle, CS_OPT_DETAIL, CS_OPT_ON);
    disassemble();
    inspect_data_function_pointers(data_function_pointers, rodata_section, rodata_vaddr, rodata_section_len);
    inspect_data_function_pointers(data_function_pointers, data_section, data_vaddr, data_section_len);
    pass1();
    pass2();
    pass3();
    pass4();
    pass5();
    pass6();
    //dump();
    dump_c();
    free(data);
    cs_close(&handle);
}