#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int /*<<< orphan*/ *fgets(char *, int, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ puts(char *);
int /*<<< orphan*/ setbuf(int /*<<< orphan*/, int /*<<< orphan*/ *);
int /*<<< orphan*/ stderr;
int /*<<< orphan*/ stdin;
int /*<<< orphan*/ stdout;
scalar_t__ strncmp(char *, char *, int);
int system(char *);
int main() {
  setbuf(stdin, NULL);
  setbuf(stdout, NULL);
  setbuf(stderr, NULL);
  char inputs[256];
  printf("Your goal: try to crash the Cauliflower system by providing input to "
         "the program which is launched by using 'run' command.\n Bonus flag "
         "for controlling the crash.\n");
  while (1) {
    printf("\nConsole commands: \nrun\nquit\n>>");
    if (fgets(inputs, 256, stdin) == NULL) {
      exit(0);
    }
    printf("Inputs: %s", inputs);
    if (strncmp(inputs, "run\n\0", 256) == 0) {
      int result = system("/usr/bin/qemu-mipsel-static ./bof");
      continue;
    } else if (strncmp(inputs, "quit\n\0", 256) == 0) {
      exit(0);
    } else {
      puts("Unable to determine action from your input");
      exit(0);
    }
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x120,%rsp
movl   $0x0,-0x4(%rbp)
mov    0x2e5f(%rip),%rax
mov    (%rax),%edi
xor    %eax,%eax
mov    %eax,%esi
call   1050 <setbuf@plt>
mov    0x2e35(%rip),%rax
mov    (%rax),%edi
xor    %eax,%eax
mov    %eax,%esi
call   1050 <setbuf@plt>
mov    0x2e2b(%rip),%rax
mov    (%rax),%edi
xor    %eax,%eax
mov    %eax,%esi
call   1050 <setbuf@plt>
lea    0xe41(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
lea    0xed6(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
lea    -0x110(%rbp),%rdi
mov    0x2e06(%rip),%rax
mov    (%rax),%edx
mov    $0x100,%esi
call   1080 <fgets@plt>
cmp    $0x0,%rax
jne    11ff <main+0x8f>
xor    %edi,%edi
call   1090 <exit@plt>
lea    -0x110(%rbp),%rsi
lea    0xeb6(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
lea    -0x110(%rbp),%rdi
lea    0xef9(%rip),%rsi
mov    $0x100,%edx
call   1030 <strncmp@plt>
cmp    $0x0,%rax
jne    124d <main+0xdd>
lea    0xe91(%rip),%rdi
call   1060 <system@plt>
mov    %eax,-0x114(%rbp)
jmp    11c6 <main+0x56>
lea    -0x110(%rbp),%rdi
lea    0xec6(%rip),%rsi
mov    $0x100,%edx
call   1030 <strncmp@plt>
cmp    $0x0,%rax
jne    1276 <main+0x106>
xor    %edi,%edi
call   1090 <exit@plt>
lea    0xe73(%rip),%rdi
call   1040 <puts@plt>
xor    %edi,%edi
call   1090 <exit@plt>

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x108,%rsp
mov    0x2e60(%rip),%rbp
mov    0x0(%rbp),%edi
xor    %esi,%esi
call   1050 <setbuf@plt>
mov    0x2e37(%rip),%rax
mov    (%rax),%edi
xor    %esi,%esi
call   1050 <setbuf@plt>
mov    0x2e2f(%rip),%rax
mov    (%rax),%edi
xor    %esi,%esi
call   1050 <setbuf@plt>
lea    0xebf(%rip),%rdi
call   1040 <puts@plt>
lea    0xe3b(%rip),%rdi
xor    %eax,%eax
call   1070 <printf@plt>
mov    0x0(%rbp),%edx
mov    %rsp,%rdi
mov    $0x100,%esi
call   1080 <fgets@plt>
test   %rax,%rax
je     1274 <main+0x104>
lea    0xe34(%rip),%r14
mov    %rsp,%rbx
lea    0xf24(%rip),%r15
lea    0xe2e(%rip),%r12
lea    0xdfc(%rip),%r13
cs nopw 0x0(%rax,%rax,1)
xchg   %ax,%ax
mov    %r14,%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1070 <printf@plt>
mov    %rbx,%rdi
mov    %r15,%rsi
mov    $0x100,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    125b <main+0xeb>
mov    %r12,%rdi
call   1060 <system@plt>
mov    %r13,%rdi
xor    %eax,%eax
call   1070 <printf@plt>
mov    0x0(%rbp),%edx
mov    %rbx,%rdi
mov    $0x100,%esi
call   1080 <fgets@plt>
test   %rax,%rax
jne    1210 <main+0xa0>
jmp    1274 <main+0x104>
lea    0xebe(%rip),%rsi
mov    %rsp,%rdi
mov    $0x100,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    127b <main+0x10b>
xor    %edi,%edi
call   1090 <exit@plt>
lea    0xdcb(%rip),%rdi
call   1040 <puts@plt>
xor    %edi,%edi
call   1090 <exit@plt>

LLVM IR (-O0):
@stdin = global i32 0
@stdout = global i32 0
@stderr = global i32 0
@.str = [163 x i8] c"Your goal: try to crash the Cauliflower system by providing input to the program which is launched by using 'run' command.\0A Bonus flag for controlling the crash.\0A\00"
@.str.1 = [32 x i8] c"\0AConsole commands: \0Arun\0Aquit\0A>>\00"
@.str.2 = [11 x i8] c"Inputs: %s\00"
@.str.3 = [6 x i8] c"run\0A\00\00"
@.str.4 = [34 x i8] c"/usr/bin/qemu-mipsel-static ./bof\00"
@.str.5 = [7 x i8] c"quit\0A\00\00"
@.str.6 = [43 x i8] c"Unable to determine action from your input\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [256 x i8]
%3 = alloca i32
store i32 0, i32* %1
%4 = load i32, i32* @stdin
%5 = call i32 @setbuf(i32 %4, i32* null)
%6 = load i32, i32* @stdout
%7 = call i32 @setbuf(i32 %6, i32* null)
%8 = load i32, i32* @stderr
%9 = call i32 @setbuf(i32 %8, i32* null)
%10 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([163 x i8], [163 x i8]* @.str, i64 0, i64 0))
br label %11
11: ; preds = %0, %25
%12 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([32 x i8], [32 x i8]* @.str.1, i64 0, i64 0))
%13 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%14 = load i32, i32* @stdin
%15 = call i32* @fgets(i8* %13, i32 256, i32 %14)
%16 = icmp eq i32* %15, null
br i1 %16, label %17, label %19
17: ; preds = %11
%18 = call i32 @exit(i32 0)
unreachable
19: ; preds = %11
%20 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%21 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.2, i64 0, i64 0), i8* %20)
%22 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%23 = call i64 @strncmp(i8* %22, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0), i32 256)
%24 = icmp eq i64 %23, 0
br i1 %24, label %25, label %27
25: ; preds = %19
%26 = call i32 @system(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.4, i64 0, i64 0))
store i32 %26, i32* %3
br label %11
27: ; preds = %19
%28 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%29 = call i64 @strncmp(i8* %28, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.5, i64 0, i64 0), i32 256)
%30 = icmp eq i64 %29, 0
br i1 %30, label %31, label %33
31: ; preds = %27
%32 = call i32 @exit(i32 0)
unreachable
33: ; preds = %27
%34 = call i32 @puts(i8* getelementptr inbounds ([43 x i8], [43 x i8]* @.str.6, i64 0, i64 0))
%35 = call i32 @exit(i32 0)
unreachable
}

LLVM IR (-O2):
@stdin = global i32 0
@stdout = global i32 0
@stderr = global i32 0
@.str.1 = [32 x i8] c"\0AConsole commands: \0Arun\0Aquit\0A>>\00"
@.str.2 = [11 x i8] c"Inputs: %s\00"
@.str.3 = [6 x i8] c"run\0A\00\00"
@.str.4 = [34 x i8] c"/usr/bin/qemu-mipsel-static ./bof\00"
@.str.5 = [7 x i8] c"quit\0A\00\00"
@.str.6 = [43 x i8] c"Unable to determine action from your input\00"
@str = [162 x i8] c"Your goal: try to crash the Cauliflower system by providing input to the program which is launched by using 'run' command.\0A Bonus flag for controlling the crash.\00"
define i32 @main() {
%1 = alloca [256 x i8]
%2 = load i32, i32* @stdin
%3 = tail call i32 @setbuf(i32 %2, i32* null)
%4 = load i32, i32* @stdout
%5 = tail call i32 @setbuf(i32 %4, i32* null)
%6 = load i32, i32* @stderr
%7 = tail call i32 @setbuf(i32 %6, i32* null)
%8 = getelementptr inbounds [256 x i8], [256 x i8]* %1, i64 0, i64 0
%9 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([162 x i8], [162 x i8]* @str, i64 0, i64 0))
%10 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([32 x i8], [32 x i8]* @.str.1, i64 0, i64 0))
%11 = load i32, i32* @stdin
%12 = call i32* @fgets(i8* %8, i32 256, i32 %11)
%13 = icmp eq i32* %12, null
br i1 %13, label %14, label %16
14: ; preds = %20, %0
%15 = call i32 @exit(i32 0)
unreachable
16: ; preds = %0, %20
%17 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([11 x i8], [11 x i8]* @.str.2, i64 0, i64 0), i8* %8)
%18 = call i64 @strncmp(i8* %8, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0), i32 256)
%19 = icmp eq i64 %18, 0
br i1 %19, label %20, label %26
20: ; preds = %16
%21 = call i32 @system(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.4, i64 0, i64 0))
%22 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([32 x i8], [32 x i8]* @.str.1, i64 0, i64 0))
%23 = load i32, i32* @stdin
%24 = call i32* @fgets(i8* %8, i32 256, i32 %23)
%25 = icmp eq i32* %24, null
br i1 %25, label %14, label %16
26: ; preds = %16
%27 = call i64 @strncmp(i8* %8, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.5, i64 0, i64 0), i32 256)
%28 = icmp eq i64 %27, 0
br i1 %28, label %29, label %31
29: ; preds = %26
%30 = call i32 @exit(i32 0)
unreachable
31: ; preds = %26
%32 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([43 x i8], [43 x i8]* @.str.6, i64 0, i64 0))
%33 = call i32 @exit(i32 0)
unreachable
}