#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ buf;

/* Variables and functions */
unsigned int EOF;
int /*<<< orphan*/ execlp(char *, char *, char *, int /*<<< orphan*/ *);
unsigned int getchar();
int /*<<< orphan*/ geteuid();
int /*<<< orphan*/ print(unsigned char *, int);
int /*<<< orphan*/ printf(char *);
int /*<<< orphan*/ setresuid(int /*<<< orphan*/, int /*<<< orphan*/,
                             int /*<<< orphan*/);
int main() {
  unsigned char buf[512];
  unsigned char *ptr = buf + (sizeof(buf) / 2);
  unsigned int x;
  while ((x = getchar()) != EOF) {
    switch (x) {
    case '\n':
      print(buf, sizeof(buf));
      continue;
      break;
    case '\\':
      ptr--;
      break;
    default:;
      if (((unsigned int)ptr & 0xff000000) == 0xca000000) {
        setresuid(geteuid(), geteuid(), geteuid());
        execlp("/bin/sh", "sh", "-i", NULL);
      };
      if (ptr > buf + sizeof(buf))
        continue;
      ptr++[0] = x;
      break;
    }
  }
  printf("All done\n");
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x230,%rsp
movl   $0x0,-0x4(%rbp)
lea    -0x210(%rbp),%rax
add    $0x100,%rax
mov    %rax,-0x218(%rbp)
mov    $0x0,%al
call   1070 <getchar@plt>
mov    %eax,-0x21c(%rbp)
mov    0x2e4e(%rip),%rcx
cmp    (%rcx),%eax
je     12ad <main+0x14d>
mov    -0x21c(%rbp),%eax
mov    %eax,-0x220(%rbp)
sub    $0xa,%eax
je     11d0 <main+0x70>
jmp    11bc <main+0x5c>
mov    -0x220(%rbp),%eax
sub    $0x5c,%eax
je     11e6 <main+0x86>
jmp    11fd <main+0x9d>
lea    -0x210(%rbp),%rdi
mov    $0x200,%esi
call   1060 <print@plt>
jmp    1186 <main+0x26>
mov    -0x218(%rbp),%rax
add    $0xffffffffffffffff,%rax
mov    %rax,-0x218(%rbp)
jmp    12a8 <main+0x148>
mov    -0x218(%rbp),%rax
and    $0xff000000,%eax
cmp    $0xca000000,%eax
jne    1266 <main+0x106>
mov    $0x0,%al
call   1050 <geteuid@plt>
mov    %eax,-0x228(%rbp)
mov    $0x0,%al
call   1050 <geteuid@plt>
mov    %eax,-0x224(%rbp)
mov    $0x0,%al
call   1050 <geteuid@plt>
mov    -0x228(%rbp),%edi
mov    -0x224(%rbp),%esi
mov    %eax,%edx
call   1030 <setresuid@plt>
lea    0xdb1(%rip),%rdi
lea    0xdaf(%rip),%rsi
lea    0xdab(%rip),%rdx
xor    %eax,%eax
mov    %eax,%ecx
call   1080 <execlp@plt>
mov    -0x218(%rbp),%rax
lea    -0x210(%rbp),%rcx
add    $0x200,%rcx
cmp    %rcx,%rax
jbe    1289 <main+0x129>
jmp    1186 <main+0x26>
mov    -0x21c(%rbp),%eax
mov    %al,%cl
mov    -0x218(%rbp),%rax
mov    %rax,%rdx
add    $0x1,%rdx
mov    %rdx,-0x218(%rbp)
mov    %cl,(%rax)
jmp    1186 <main+0x26>
lea    0xd57(%rip),%rdi
call   1040 <printf@plt>
mov    -0x4(%rbp),%eax
add    $0x230,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x208,%rsp
xor    %eax,%eax
call   1070 <getchar@plt>
mov    0x2e69(%rip),%r13
cmp    0x0(%r13),%eax
jne    11a5 <main+0x45>
lea    0xe7f(%rip),%rdi
call   1030 <puts@plt>
xor    %eax,%eax
add    $0x208,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    %eax,%ebp
lea    0x100(%rsp),%r15
mov    %rsp,%r12
mov    %r15d,%ebx
and    $0xff000000,%ebx
jmp    11dc <main+0x7c>
nopl   (%rax)
mov    %r12,%rdi
mov    $0x200,%esi
call   1060 <print@plt>
xor    %eax,%eax
call   1070 <getchar@plt>
mov    %eax,%ebp
cmp    0x0(%r13),%eax
je     1185 <main+0x25>
cmp    $0xa,%ebp
je     11c0 <main+0x60>
cmp    $0x5c,%ebp
je     1260 <main+0x100>
cmp    $0xca000000,%ebx
jne    123b <main+0xdb>
xor    %eax,%eax
call   1050 <geteuid@plt>
mov    %r15,%r12
mov    %eax,%r15d
xor    %eax,%eax
call   1050 <geteuid@plt>
mov    %eax,%r14d
xor    %eax,%eax
call   1050 <geteuid@plt>
mov    %r15d,%edi
mov    %r12,%r15
mov    %rsp,%r12
mov    %r14d,%esi
mov    %eax,%edx
call   1040 <setresuid@plt>
lea    0xdda(%rip),%rdi
lea    0xdd8(%rip),%rsi
lea    0xdd4(%rip),%rdx
xor    %ecx,%ecx
call   1080 <execlp@plt>
lea    0x200(%rsp),%rax
cmp    %rax,%r15
ja     11cd <main+0x6d>
mov    %bpl,(%r15)
add    $0x1,%r15
jmp    1264 <main+0x104>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
add    $0xffffffffffffffff,%r15
xor    %eax,%eax
call   1070 <getchar@plt>
mov    %eax,%ebp
cmp    0x0(%r13),%eax
jne    11b2 <main+0x52>
jmp    1185 <main+0x25>

LLVM IR (-O0):
@EOF = global i32 0
@.str = [8 x i8] c"/bin/sh\00"
@.str.1 = [3 x i8] c"sh\00"
@.str.2 = [3 x i8] c"-i\00"
@.str.3 = [10 x i8] c"All done\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [512 x i8]
%3 = alloca i8*
%4 = alloca i32
store i32 0, i32* %1
%5 = getelementptr inbounds [512 x i8], [512 x i8]* %2, i64 0, i64 0
%6 = getelementptr inbounds i8, i8* %5, i64 256
store i8* %6, i8** %3
br label %7
7: ; preds = %42, %35, %13, %0
%8 = call i32 (...) @getchar()
store i32 %8, i32* %4
%9 = load i32, i32* @EOF
%10 = icmp ne i32 %8, %9
br i1 %10, label %11, label %43
11: ; preds = %7
%12 = load i32, i32* %4
switch i32 %12, label %19 [
i32 10, label %13
i32 92, label %16
]
13: ; preds = %11
%14 = getelementptr inbounds [512 x i8], [512 x i8]* %2, i64 0, i64 0
%15 = call i32 @print(i8* %14, i32 512)
br label %7
16: ; preds = %11
%17 = load i8*, i8** %3
%18 = getelementptr inbounds i8, i8* %17, i32 -1
store i8* %18, i8** %3
br label %42
19: ; preds = %11
%20 = load i8*, i8** %3
%21 = ptrtoint i8* %20 to i32
%22 = and i32 %21, -16777216
%23 = icmp eq i32 %22, -905969664
br i1 %23, label %24, label %30
24: ; preds = %19
%25 = call i32 (...) @geteuid()
%26 = call i32 (...) @geteuid()
%27 = call i32 (...) @geteuid()
%28 = call i32 @setresuid(i32 %25, i32 %26, i32 %27)
%29 = call i32 @execlp(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32* null)
br label %30
30: ; preds = %24, %19
%31 = load i8*, i8** %3
%32 = getelementptr inbounds [512 x i8], [512 x i8]* %2, i64 0, i64 0
%33 = getelementptr inbounds i8, i8* %32, i64 512
%34 = icmp ugt i8* %31, %33
br i1 %34, label %35, label %36
35: ; preds = %30
br label %7
36: ; preds = %30
%37 = load i32, i32* %4
%38 = trunc i32 %37 to i8
%39 = load i8*, i8** %3
%40 = getelementptr inbounds i8, i8* %39, i32 1
store i8* %40, i8** %3
%41 = getelementptr inbounds i8, i8* %39, i64 0
store i8 %38, i8* %41
br label %42
42: ; preds = %36, %16
br label %7
43: ; preds = %7
%44 = call i32 @printf(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.3, i64 0, i64 0))
%45 = load i32, i32* %1
ret i32 %45
}

LLVM IR (-O2):
@EOF = global i32 0
@.str = [8 x i8] c"/bin/sh\00"
@.str.1 = [3 x i8] c"sh\00"
@.str.2 = [3 x i8] c"-i\00"
@str = [9 x i8] c"All done\00"
define i32 @main() {
%1 = alloca [512 x i8]
%2 = getelementptr inbounds [512 x i8], [512 x i8]* %1, i64 0, i64 0
%3 = call i32 (...) @getchar()
%4 = load i32, i32* @EOF
%5 = icmp eq i32 %3, %4
br i1 %5, label %42, label %6
6: ; preds = %0
%7 = getelementptr inbounds [512 x i8], [512 x i8]* %1, i64 0, i64 256
%8 = getelementptr inbounds [512 x i8], [512 x i8]* %1, i64 0, i64 512
br label %9
9: ; preds = %6, %37
%10 = phi i32 [ %3, %6 ], [ %39, %37 ]
%11 = phi i8* [ %7, %6 ], [ %38, %37 ]
%12 = ptrtoint i8* %11 to i64
%13 = and i64 %12, 4278190080
%14 = icmp eq i64 %13, 3388997632
%15 = icmp ugt i8* %11, %8
br label %16
16: ; preds = %9, %20
%17 = phi i32 [ %10, %9 ], [ %21, %20 ]
switch i32 %17, label %26 [
i32 10, label %18
i32 92, label %24
]
18: ; preds = %16
%19 = call i32 @print(i8* %2, i32 512)
br label %20
20: ; preds = %18, %33
%21 = call i32 (...) @getchar()
%22 = load i32, i32* @EOF
%23 = icmp eq i32 %21, %22
br i1 %23, label %42, label %16
24: ; preds = %16
%25 = getelementptr inbounds i8, i8* %11, i64 -1
br label %37
26: ; preds = %16
br i1 %14, label %27, label %33
27: ; preds = %26
%28 = call i32 (...) @geteuid()
%29 = call i32 (...) @geteuid()
%30 = call i32 (...) @geteuid()
%31 = call i32 @setresuid(i32 %28, i32 %29, i32 %30)
%32 = call i32 @execlp(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32* null)
br label %33
33: ; preds = %27, %26
br i1 %15, label %20, label %34
34: ; preds = %33
%35 = trunc i32 %17 to i8
%36 = getelementptr inbounds i8, i8* %11, i64 1
store i8 %35, i8* %11
br label %37
37: ; preds = %34, %24
%38 = phi i8* [ %36, %34 ], [ %25, %24 ]
%39 = call i32 (...) @getchar()
%40 = load i32, i32* @EOF
%41 = icmp eq i32 %39, %40
br i1 %41, label %42, label %9
42: ; preds = %37, %20, %0
%43 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @str, i64 0, i64 0))
ret i32 0
}