#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ setuid(int /*<<< orphan*/);
int /*<<< orphan*/ system(char *);
void secureapp(int *level) {
  if (*level == 0) {
    printf("Not allowed to access this resource\n");
  } else if (*level < 0x10000) {
    printf("Your privilege level is %x\n", *level);
  } else {
    printf("Granted elevated privileges\n");
    setuid(0);
    system("cat /etc/passwd");
    system("/bin/sh");
  }
}


x86 assembly (clang, -O0):
<secureapp>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    %rdi,-0x8(%rbp)
mov    -0x8(%rbp),%rax
cmpl   $0x0,(%rax)
jne    115c <secureapp+0x2c>
lea    0xeb0(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
jmp    11b7 <secureapp+0x87>
mov    -0x8(%rbp),%rax
cmpl   $0x10000,(%rax)
jge    1185 <secureapp+0x55>
mov    -0x8(%rbp),%rax
mov    (%rax),%esi
lea    0xeac(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
jmp    11b2 <secureapp+0x82>
lea    0xeb5(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
xor    %edi,%edi
call   1050 <setuid@plt>
lea    0xebd(%rip),%rdi
call   1030 <system@plt>
lea    0xec1(%rip),%rdi
call   1030 <system@plt>
jmp    11b7 <secureapp+0x87>
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<secureapp>:
push   %rax
mov    (%rdi),%esi
test   %esi,%esi
je     115e <secureapp+0x1e>
cmp    $0xffff,%esi
jg     116b <secureapp+0x2b>
lea    0xeaa(%rip),%rdi
xor    %eax,%eax
pop    %rcx
jmp    1050 <printf@plt>
lea    0xeeb(%rip),%rdi
pop    %rax
jmp    1030 <puts@plt>
lea    0xec2(%rip),%rdi
call   1030 <puts@plt>
xor    %edi,%edi
call   1060 <setuid@plt>
lea    0xe97(%rip),%rdi
call   1040 <system@plt>
lea    0xe9b(%rip),%rdi
pop    %rax
jmp    1040 <system@plt>

LLVM IR (-O0):
@.str = [37 x i8] c"Not allowed to access this resource\0A\00"
@.str.1 = [28 x i8] c"Your privilege level is %x\0A\00"
@.str.2 = [29 x i8] c"Granted elevated privileges\0A\00"
@.str.3 = [16 x i8] c"cat /etc/passwd\00"
@.str.4 = [8 x i8] c"/bin/sh\00"
define void @secureapp(i32* %0) {
%2 = alloca i32*
store i32* %0, i32** %2
%3 = load i32*, i32** %2
%4 = load i32, i32* %3
%5 = icmp eq i32 %4, 0
br i1 %5, label %6, label %8
6: ; preds = %1
%7 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str, i64 0, i64 0))
br label %22
8: ; preds = %1
%9 = load i32*, i32** %2
%10 = load i32, i32* %9
%11 = icmp slt i32 %10, 65536
br i1 %11, label %12, label %16
12: ; preds = %8
%13 = load i32*, i32** %2
%14 = load i32, i32* %13
%15 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.1, i64 0, i64 0), i32 %14)
br label %21
16: ; preds = %8
%17 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.2, i64 0, i64 0))
%18 = call i32 @setuid(i32 0)
%19 = call i32 @system(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.3, i64 0, i64 0))
%20 = call i32 @system(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.4, i64 0, i64 0))
br label %21
21: ; preds = %16, %12
br label %22
22: ; preds = %21, %6
ret void
}

LLVM IR (-O2):
@.str.1 = [28 x i8] c"Your privilege level is %x\0A\00"
@.str.3 = [16 x i8] c"cat /etc/passwd\00"
@.str.4 = [8 x i8] c"/bin/sh\00"
@str = [28 x i8] c"Granted elevated privileges\00"
@str.5 = [36 x i8] c"Not allowed to access this resource\00"
define void @secureapp(i32* nocapture %0) {
%2 = load i32, i32* %0
%3 = icmp eq i32 %2, 0
br i1 %3, label %4, label %6
4: ; preds = %1
%5 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([36 x i8], [36 x i8]* @str.5, i64 0, i64 0))
br label %15
6: ; preds = %1
%7 = icmp slt i32 %2, 65536
br i1 %7, label %8, label %10
8: ; preds = %6
%9 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([28 x i8], [28 x i8]* @.str.1, i64 0, i64 0), i32 %2)
br label %15
10: ; preds = %6
%11 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([28 x i8], [28 x i8]* @str, i64 0, i64 0))
%12 = tail call i32 @setuid(i32 0)
%13 = tail call i32 @system(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.3, i64 0, i64 0))
%14 = tail call i32 @system(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.4, i64 0, i64 0))
br label %15
15: ; preds = %8, %10, %4
ret void
}