#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ str;

/* Variables and functions */
int /*<<< orphan*/ execv(char *, char **);
int /*<<< orphan*/ fgets(char *, int, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *);
int /*<<< orphan*/ setresuid(int, int, int);
int /*<<< orphan*/ stdin;
scalar_t__ strcmp(char *, char *);
int main(int argc, char **argv) {
  char str[5];
  printf("Enter 4-digit PIN: ");
  fgets(str, sizeof(str), stdin);
  if (strcmp(str, "6666") == 0) {
    setresuid(2008, 2008, 2008);
    execv("/bin/sh", argv);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    0xe93(%rip),%rdi
call   1040 <printf@plt>
lea    -0x15(%rbp),%rdi
mov    0x2e6b(%rip),%rax
mov    (%rax),%edx
mov    $0x5,%esi
call   1050 <fgets@plt>
lea    -0x15(%rbp),%rdi
lea    0xe80(%rip),%rsi
call   1060 <strcmp@plt>
cmp    $0x0,%rax
jne    11c1 <main+0x71>
mov    $0x7d8,%edx
mov    %edx,%edi
mov    %edx,%esi
call   1030 <setresuid@plt>
mov    -0x10(%rbp),%rsi
lea    0xe5d(%rip),%rdi
call   1070 <execv@plt>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
push   %rax
mov    %rsi,%r14
lea    0xea2(%rip),%rdi
call   1040 <printf@plt>
mov    0x2e7e(%rip),%rax
mov    (%rax),%edx
lea    0x3(%rsp),%rbx
mov    %rbx,%rdi
mov    $0x5,%esi
call   1050 <fgets@plt>
lea    0xe8f(%rip),%rsi
mov    %rbx,%rdi
call   1060 <strcmp@plt>
test   %rax,%rax
jne    11b5 <main+0x65>
mov    $0x7d8,%edi
mov    $0x7d8,%esi
mov    $0x7d8,%edx
call   1030 <setresuid@plt>
lea    0xe6c(%rip),%rdi
mov    %r14,%rsi
call   1070 <execv@plt>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@.str = [20 x i8] c"Enter 4-digit PIN: \00"
@stdin = global i32 0
@.str.1 = [5 x i8] c"6666\00"
@.str.2 = [8 x i8] c"/bin/sh\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca [5 x i8]
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%7 = call i32 @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str, i64 0, i64 0))
%8 = getelementptr inbounds [5 x i8], [5 x i8]* %6, i64 0, i64 0
%9 = load i32, i32* @stdin
%10 = call i32 @fgets(i8* %8, i32 5, i32 %9)
%11 = getelementptr inbounds [5 x i8], [5 x i8]* %6, i64 0, i64 0
%12 = call i64 @strcmp(i8* %11, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.1, i64 0, i64 0))
%13 = icmp eq i64 %12, 0
br i1 %13, label %14, label %18
14: ; preds = %2
%15 = call i32 @setresuid(i32 2008, i32 2008, i32 2008)
%16 = load i8**, i8*** %5
%17 = call i32 @execv(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0), i8** %16)
br label %18
18: ; preds = %14, %2
ret i32 0
}

LLVM IR (-O2):
@.str = [20 x i8] c"Enter 4-digit PIN: \00"
@stdin = global i32 0
@.str.1 = [5 x i8] c"6666\00"
@.str.2 = [8 x i8] c"/bin/sh\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca [5 x i8]
%4 = getelementptr inbounds [5 x i8], [5 x i8]* %3, i64 0, i64 0
%5 = tail call i32 @printf(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @.str, i64 0, i64 0))
%6 = load i32, i32* @stdin
%7 = call i32 @fgets(i8* %4, i32 5, i32 %6)
%8 = call i64 @strcmp(i8* %4, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.1, i64 0, i64 0))
%9 = icmp eq i64 %8, 0
br i1 %9, label %10, label %13
10: ; preds = %2
%11 = call i32 @setresuid(i32 2008, i32 2008, i32 2008)
%12 = call i32 @execv(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0), i8** %1)
br label %13
13: ; preds = %10, %2
ret i32 0
}