#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ mpz_t;

/* Variables and functions */
int /*<<< orphan*/ execlp(char *, char *, int /*<<< orphan*/ *);
int /*<<< orphan*/ geteuid();
int mpz_cmp(int /*<<< orphan*/, int /*<<< orphan*/);
int /*<<< orphan*/ mpz_init(int /*<<< orphan*/);
int /*<<< orphan*/ mpz_mul(int /*<<< orphan*/, int /*<<< orphan*/,
                           int /*<<< orphan*/);
int /*<<< orphan*/ mpz_set_str(int /*<<< orphan*/, char *, int);
int /*<<< orphan*/ mpz_set_ui(int /*<<< orphan*/, unsigned long);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ setresuid(int /*<<< orphan*/, int /*<<< orphan*/,
                             int /*<<< orphan*/);
int strlen(char *);
int /*<<< orphan*/ strncpy(char *, char *, int);
int main(int argc, char *argv[]) {
  mpz_t longjohn, mul, cmpval;
  char userstr[512 + 1];
  int n = 0;
  mpz_init(longjohn);
  mpz_set_ui(longjohn, 1);
  mpz_init(mul);
  mpz_init(cmpval);
  mpz_set_str(
      cmpval,
      "insert-here-the-password-hash-from-your-home-directory-on-semtex-7", 10);
  if (argc < 2) {
    printf("%s <string>\n", argv[0]);
    return -1;
  }
  strncpy(userstr, argv[1], 512);
  for (n = 0; n < strlen(userstr); n++) {
    mpz_set_ui(mul, (unsigned long)(userstr[n] + 27137));
    mpz_mul(longjohn, longjohn, mul);
  }
  if (!(n = mpz_cmp(longjohn, cmpval))) {
    setresuid(geteuid(), geteuid(), geteuid());
    execlp("/bin/bash", "bash", NULL);
  } else
    printf("err... booom!\n");
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x230,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x0,-0x224(%rbp)
mov    -0x14(%rbp),%edi
call   1080 <mpz_init@plt>
mov    -0x14(%rbp),%edi
mov    $0x1,%esi
call   10c0 <mpz_set_ui@plt>
mov    -0x18(%rbp),%edi
call   1080 <mpz_init@plt>
mov    -0x1c(%rbp),%edi
call   1080 <mpz_init@plt>
mov    -0x1c(%rbp),%edi
lea    0xdfe(%rip),%rsi
mov    $0xa,%edx
call   10a0 <mpz_set_str@plt>
cmpl   $0x2,-0x8(%rbp)
jge    1237 <main+0x87>
mov    -0x10(%rbp),%rax
mov    (%rax),%rsi
lea    0xe1f(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1342 <main+0x192>
lea    -0x220(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rsi
mov    $0x200,%edx
call   1030 <strncpy@plt>
movl   $0x0,-0x224(%rbp)
mov    -0x224(%rbp),%eax
mov    %eax,-0x228(%rbp)
lea    -0x220(%rbp),%rdi
call   1050 <strlen@plt>
mov    %eax,%ecx
mov    -0x228(%rbp),%eax
cmp    %ecx,%eax
jge    12c3 <main+0x113>
mov    -0x18(%rbp),%edi
movslq -0x224(%rbp),%rax
movsbl -0x220(%rbp,%rax,1),%eax
ff
add    $0x6a01,%eax
movslq %eax,%rsi
call   10c0 <mpz_set_ui@plt>
mov    -0x14(%rbp),%edi
mov    -0x14(%rbp),%esi
mov    -0x18(%rbp),%edx
call   1090 <mpz_mul@plt>
mov    -0x224(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x224(%rbp)
jmp    125a <main+0xaa>
mov    -0x14(%rbp),%edi
mov    -0x1c(%rbp),%esi
call   10b0 <mpz_cmp@plt>
mov    %eax,-0x224(%rbp)
cmp    $0x0,%eax
jne    132d <main+0x17d>
mov    $0x0,%al
call   1070 <geteuid@plt>
mov    %eax,-0x230(%rbp)
mov    $0x0,%al
call   1070 <geteuid@plt>
mov    %eax,-0x22c(%rbp)
mov    $0x0,%al
call   1070 <geteuid@plt>
mov    -0x230(%rbp),%edi
mov    -0x22c(%rbp),%esi
mov    %eax,%edx
call   1040 <setresuid@plt>
lea    0xd38(%rip),%rdi
lea    0xd36(%rip),%rsi
xor    %eax,%eax
mov    %eax,%edx
call   10d0 <execlp@plt>
jmp    133b <main+0x18b>
lea    0xd26(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x230,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r14
push   %rbx
sub    $0x210,%rsp
mov    %rsi,%rbx
mov    %edi,%ebp
call   1090 <mpz_init@plt>
mov    $0x1,%esi
call   10d0 <mpz_set_ui@plt>
call   1090 <mpz_init@plt>
call   1090 <mpz_init@plt>
lea    0xe10(%rip),%rsi
mov    $0xa,%edx
call   10b0 <mpz_set_str@plt>
cmp    $0x1,%ebp
jg     121a <main+0x5a>
mov    (%rbx),%rsi
lea    0xe3a(%rip),%rdi
xor    %eax,%eax
call   1070 <printf@plt>
mov    $0xffffffff,%ebx
jmp    12bf <main+0xff>
mov    0x8(%rbx),%rsi
mov    %rsp,%rbx
mov    %rbx,%rdi
mov    $0x200,%edx
call   1030 <strncpy@plt>
mov    %rbx,%rdi
call   1060 <strlen@plt>
test   %eax,%eax
jle    1269 <main+0xa9>
xor    %ebp,%ebp
mov    %rsp,%rbx
nop
movsbq (%rsp,%rbp,1),%rsi
add    $0x6a01,%rsi
call   10d0 <mpz_set_ui@plt>
call   10a0 <mpz_mul@plt>
add    $0x1,%rbp
mov    %rbx,%rdi
call   1060 <strlen@plt>
cltq
cmp    %rax,%rbp
jl     1240 <main+0x80>
call   10c0 <mpz_cmp@plt>
test   %eax,%eax
je     1282 <main+0xc2>
lea    0xde1(%rip),%rdi
call   1040 <puts@plt>
xor    %ebx,%ebx
jmp    12bf <main+0xff>
xor    %ebx,%ebx
xor    %eax,%eax
call   1080 <geteuid@plt>
mov    %eax,%r14d
xor    %eax,%eax
call   1080 <geteuid@plt>
mov    %eax,%ebp
xor    %eax,%eax
call   1080 <geteuid@plt>
mov    %r14d,%edi
mov    %ebp,%esi
mov    %eax,%edx
call   1050 <setresuid@plt>
lea    0xd9f(%rip),%rdi
lea    0xd9d(%rip),%rsi
xor    %edx,%edx
call   10e0 <execlp@plt>
mov    %ebx,%eax
add    $0x210,%rsp
pop    %rbx
pop    %r14
pop    %rbp
ret

LLVM IR (-O0):
@.str = [67 x i8] c"insert-here-the-password-hash-from-your-home-directory-on-semtex-7\00"
@.str.1 = [13 x i8] c"%s <string>\0A\00"
@.str.2 = [10 x i8] c"/bin/bash\00"
@.str.3 = [5 x i8] c"bash\00"
@.str.4 = [15 x i8] c"err... booom!\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca [513 x i8]
%10 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 0, i32* %10
%11 = load i32, i32* %6
%12 = call i32 @mpz_init(i32 %11)
%13 = load i32, i32* %6
%14 = call i32 @mpz_set_ui(i32 %13, i64 1)
%15 = load i32, i32* %7
%16 = call i32 @mpz_init(i32 %15)
%17 = load i32, i32* %8
%18 = call i32 @mpz_init(i32 %17)
%19 = load i32, i32* %8
%20 = call i32 @mpz_set_str(i32 %19, i8* getelementptr inbounds ([67 x i8], [67 x i8]* @.str, i64 0, i64 0), i32 10)
%21 = load i32, i32* %4
%22 = icmp slt i32 %21, 2
br i1 %22, label %23, label %28
23: ; preds = %2
%24 = load i8**, i8*** %5
%25 = getelementptr inbounds i8*, i8** %24, i64 0
%26 = load i8*, i8** %25
%27 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.1, i64 0, i64 0), i8* %26)
store i32 -1, i32* %3
br label %70
28: ; preds = %2
%29 = getelementptr inbounds [513 x i8], [513 x i8]* %9, i64 0, i64 0
%30 = load i8**, i8*** %5
%31 = getelementptr inbounds i8*, i8** %30, i64 1
%32 = load i8*, i8** %31
%33 = call i32 @strncpy(i8* %29, i8* %32, i32 512)
store i32 0, i32* %10
br label %34
34: ; preds = %53, %28
%35 = load i32, i32* %10
%36 = getelementptr inbounds [513 x i8], [513 x i8]* %9, i64 0, i64 0
%37 = call i32 @strlen(i8* %36)
%38 = icmp slt i32 %35, %37
br i1 %38, label %39, label %56
39: ; preds = %34
%40 = load i32, i32* %7
%41 = load i32, i32* %10
%42 = sext i32 %41 to i64
%43 = getelementptr inbounds [513 x i8], [513 x i8]* %9, i64 0, i64 %42
%44 = load i8, i8* %43
%45 = sext i8 %44 to i32
%46 = add nsw i32 %45, 27137
%47 = sext i32 %46 to i64
%48 = call i32 @mpz_set_ui(i32 %40, i64 %47)
%49 = load i32, i32* %6
%50 = load i32, i32* %6
%51 = load i32, i32* %7
%52 = call i32 @mpz_mul(i32 %49, i32 %50, i32 %51)
br label %53
53: ; preds = %39
%54 = load i32, i32* %10
%55 = add nsw i32 %54, 1
store i32 %55, i32* %10
br label %34
56: ; preds = %34
%57 = load i32, i32* %6
%58 = load i32, i32* %8
%59 = call i32 @mpz_cmp(i32 %57, i32 %58)
store i32 %59, i32* %10
%60 = icmp ne i32 %59, 0
br i1 %60, label %67, label %61
61: ; preds = %56
%62 = call i32 (...) @geteuid()
%63 = call i32 (...) @geteuid()
%64 = call i32 (...) @geteuid()
%65 = call i32 @setresuid(i32 %62, i32 %63, i32 %64)
%66 = call i32 @execlp(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.3, i64 0, i64 0), i32* null)
br label %69
67: ; preds = %56
%68 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.4, i64 0, i64 0))
br label %69
69: ; preds = %67, %61
store i32 0, i32* %3
br label %70
70: ; preds = %69, %23
%71 = load i32, i32* %3
ret i32 %71
}

LLVM IR (-O2):
@.str = [67 x i8] c"insert-here-the-password-hash-from-your-home-directory-on-semtex-7\00"
@.str.1 = [13 x i8] c"%s <string>\0A\00"
@.str.2 = [10 x i8] c"/bin/bash\00"
@.str.3 = [5 x i8] c"bash\00"
@str = [14 x i8] c"err... booom!\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca [513 x i8]
%4 = getelementptr inbounds [513 x i8], [513 x i8]* %3, i64 0, i64 0
%5 = tail call i32 @mpz_init(i32 undef)
%6 = tail call i32 @mpz_set_ui(i32 undef, i64 1)
%7 = tail call i32 @mpz_init(i32 undef)
%8 = tail call i32 @mpz_init(i32 undef)
%9 = tail call i32 @mpz_set_str(i32 undef, i8* getelementptr inbounds ([67 x i8], [67 x i8]* @.str, i64 0, i64 0), i32 10)
%10 = icmp slt i32 %0, 2
br i1 %10, label %11, label %14
11: ; preds = %2
%12 = load i8*, i8** %1
%13 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([13 x i8], [13 x i8]* @.str.1, i64 0, i64 0), i8* %12)
br label %43
14: ; preds = %2
%15 = getelementptr inbounds i8*, i8** %1, i64 1
%16 = load i8*, i8** %15
%17 = call i32 @strncpy(i8* %4, i8* %16, i32 512)
%18 = call i32 @strlen(i8* %4)
%19 = icmp sgt i32 %18, 0
br i1 %19, label %20, label %32
20: ; preds = %14, %20
%21 = phi i64 [ %28, %20 ], [ 0, %14 ]
%22 = getelementptr inbounds [513 x i8], [513 x i8]* %3, i64 0, i64 %21
%23 = load i8, i8* %22
%24 = sext i8 %23 to i64
%25 = add nsw i64 %24, 27137
%26 = call i32 @mpz_set_ui(i32 undef, i64 %25)
%27 = call i32 @mpz_mul(i32 undef, i32 undef, i32 undef)
%28 = add nuw nsw i64 %21, 1
%29 = call i32 @strlen(i8* %4)
%30 = sext i32 %29 to i64
%31 = icmp slt i64 %28, %30
br i1 %31, label %20, label %32
32: ; preds = %20, %14
%33 = call i32 @mpz_cmp(i32 undef, i32 undef)
%34 = icmp eq i32 %33, 0
br i1 %34, label %35, label %41
35: ; preds = %32
%36 = call i32 (...) @geteuid()
%37 = call i32 (...) @geteuid()
%38 = call i32 (...) @geteuid()
%39 = call i32 @setresuid(i32 %36, i32 %37, i32 %38)
%40 = call i32 @execlp(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.3, i64 0, i64 0), i32* null)
br label %43
41: ; preds = %32
%42 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([14 x i8], [14 x i8]* @str, i64 0, i64 0))
br label %43
43: ; preds = %35, %41, %11
%44 = phi i32 [ -1, %11 ], [ 0, %41 ], [ 0, %35 ]
ret i32 %44
}