#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ chdir(char const *);
int /*<<< orphan*/ execve(char *, char **, int /*<<< orphan*/ *);
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, char *);
int /*<<< orphan*/ perror(char *);
scalar_t__ setgid(int /*<<< orphan*/);
scalar_t__ setuid(int /*<<< orphan*/);
int /*<<< orphan*/ stderr;
scalar_t__ strncmp(char *, char *, int);
int main(int argc, char **argv) {
  const char *directory = NULL;
  int programArg = 1;
  int i;
  if (argc < 2) {
    fprintf(stderr, "Usage: %s {-chdir=Directory} [Program] {Argument} ...\n",
            argv[0]);
    exit(1);
  }
  for (i = 1; i < argc; i++) {
    if (argv[i][0] == '-') {
      programArg = i + 1;
      if (strncmp(argv[i], "-chdir=", 7) == 0) {
        directory = (const char *)&argv[i][7];
      } else {
        fprintf(stderr, "ERROR: Bad parameter \"%s\".\n", argv[i]);
        exit(1);
      }
    } else {
      break;
    }
  }
  if ((setuid(0) == 0) && (setgid(0) == 0)) {
    if (directory) {
      if (chdir(directory) != 0) {
        perror("Unable to change directory");
        exit(1);
      }
    }
    execve(argv[programArg], &argv[programArg], NULL);
    perror("Unable to start program");
  } else {
    perror("Unable obtain root permissions. Ensure that rootshell is owned by "
           "root and has setuid set! Error");
  }
  return (1);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
movl   $0x1,-0x1c(%rbp)
cmpl   $0x2,-0x8(%rbp)
jge    11d5 <main+0x55>
mov    0x2e2a(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    (%rax),%rdx
lea    0xe3a(%rip),%rsi
call   1060 <fprintf@plt>
mov    $0x1,%edi
call   1090 <exit@plt>
movl   $0x1,-0x20(%rbp)
mov    -0x20(%rbp),%eax
cmp    -0x8(%rbp),%eax
jge    1291 <main+0x111>
mov    -0x10(%rbp),%rax
movslq -0x20(%rbp),%rcx
mov    (%rax,%rcx,8),%rax
movsbl (%rax),%eax
cmp    $0x2d,%eax
jne    1279 <main+0xf9>
mov    -0x20(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
mov    -0x10(%rbp),%rax
movslq -0x20(%rbp),%rcx
mov    (%rax,%rcx,8),%rdi
lea    0xe1b(%rip),%rsi
mov    $0x7,%edx
call   1030 <strncmp@plt>
cmp    $0x0,%rax
jne    1249 <main+0xc9>
mov    -0x10(%rbp),%rax
movslq -0x20(%rbp),%rcx
mov    (%rax,%rcx,8),%rax
add    $0x7,%rax
mov    %rax,-0x18(%rbp)
jmp    1274 <main+0xf4>
mov    0x2d90(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
movslq -0x20(%rbp),%rcx
mov    (%rax,%rcx,8),%rdx
lea    0xdda(%rip),%rsi
call   1060 <fprintf@plt>
mov    $0x1,%edi
call   1090 <exit@plt>
jmp    127e <main+0xfe>
jmp    1291 <main+0x111>
jmp    1283 <main+0x103>
mov    -0x20(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x20(%rbp)
jmp    11dc <main+0x5c>
xor    %edi,%edi
call   10a0 <setuid@plt>
cmp    $0x0,%rax
jne    1321 <main+0x1a1>
xor    %edi,%edi
call   1070 <setgid@plt>
cmp    $0x0,%rax
jne    1321 <main+0x1a1>
cmpq   $0x0,-0x18(%rbp)
je     12ec <main+0x16c>
mov    -0x18(%rbp),%rdi
call   1040 <chdir@plt>
cmp    $0x0,%rax
je     12e7 <main+0x167>
lea    0xd83(%rip),%rdi
call   1080 <perror@plt>
mov    $0x1,%edi
call   1090 <exit@plt>
jmp    12ec <main+0x16c>
mov    -0x10(%rbp),%rax
movslq -0x1c(%rbp),%rcx
mov    (%rax,%rcx,8),%rdi
mov    -0x10(%rbp),%rsi
movslq -0x1c(%rbp),%rax
shl    $0x3,%rax
add    %rax,%rsi
xor    %eax,%eax
mov    %eax,%edx
call   1050 <execve@plt>
lea    0xd5f(%rip),%rdi
call   1080 <perror@plt>
jmp    132d <main+0x1ad>
lea    0xd66(%rip),%rdi
call   1080 <perror@plt>
mov    $0x1,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %rsi,%r12
cmp    $0x2,%edi
jl     1292 <main+0x112>
mov    %edi,%r14d
mov    0x8(%r12),%rdi
cmpb   $0x2d,(%rdi)
jne    11fb <main+0x7b>
mov    %r14d,%eax
mov    $0x2,%r13d
sub    %rax,%r13
mov    $0x1,%ebx
lea    0xe7b(%rip),%r15
nopl   0x0(%rax)
mov    %r15,%rsi
mov    $0x7,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    126f <main+0xef>
lea    (%rbx,%r13,1),%rax
mov    (%r12,%rbx,8),%rbp
cmp    $0x1,%rax
je     1205 <main+0x85>
mov    0x8(%r12,%rbx,8),%rdi
add    $0x1,%rbx
cmpb   $0x2d,(%rdi)
je     11c0 <main+0x40>
add    $0x7,%rbp
mov    %ebx,%r14d
jmp    1209 <main+0x89>
mov    $0x1,%r14d
xor    %ebp,%ebp
jmp    1209 <main+0x89>
add    $0x7,%rbp
xor    %edi,%edi
call   10a0 <setuid@plt>
lea    0xe77(%rip),%r15
test   %rax,%rax
jne    1253 <main+0xd3>
xor    %edi,%edi
call   1070 <setgid@plt>
test   %rax,%rax
jne    1253 <main+0xd3>
test   %rbp,%rbp
je     123a <main+0xba>
mov    %rbp,%rdi
call   1040 <chdir@plt>
test   %rax,%rax
jne    12a8 <main+0x128>
mov    %r14d,%eax
lea    (%r12,%rax,8),%rsi
mov    (%r12,%rax,8),%rdi
xor    %edx,%edx
call   1050 <execve@plt>
lea    0xe23(%rip),%r15
mov    %r15,%rdi
call   1080 <perror@plt>
mov    $0x1,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    0x2d6a(%rip),%rax
mov    (%rax),%edi
mov    (%r12,%rbx,8),%rdx
lea    0xdbc(%rip),%rsi
call   1060 <fprintf@plt>
mov    $0x1,%edi
call   1090 <exit@plt>
mov    0x2d47(%rip),%rax
mov    (%rax),%edi
mov    (%r12),%rdx
lea    0xd5a(%rip),%rsi
jmp    1283 <main+0x103>
lea    0xdac(%rip),%rdi
call   1080 <perror@plt>
mov    $0x1,%edi
call   1090 <exit@plt>

LLVM IR (-O0):
@stderr = global i32 0
@.str = [55 x i8] c"Usage: %s {-chdir=Directory} [Program] {Argument} ...\0A\00"
@.str.1 = [8 x i8] c"-chdir=\00"
@.str.2 = [28 x i8] c"ERROR: Bad parameter \22%s\22.\0A\00"
@.str.3 = [27 x i8] c"Unable to change directory\00"
@.str.4 = [24 x i8] c"Unable to start program\00"
@.str.5 = [97 x i8] c"Unable obtain root permissions. Ensure that rootshell is owned by root and has setuid set! Error\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i8* null, i8** %6
store i32 1, i32* %7
%9 = load i32, i32* %4
%10 = icmp slt i32 %9, 2
br i1 %10, label %11, label %18
11: ; preds = %2
%12 = load i32, i32* @stderr
%13 = load i8**, i8*** %5
%14 = getelementptr inbounds i8*, i8** %13, i64 0
%15 = load i8*, i8** %14
%16 = call i32 @fprintf(i32 %12, i8* getelementptr inbounds ([55 x i8], [55 x i8]* @.str, i64 0, i64 0), i8* %15)
%17 = call i32 @exit(i32 1)
unreachable
18: ; preds = %2
store i32 1, i32* %8
br label %19
19: ; preds = %62, %18
%20 = load i32, i32* %8
%21 = load i32, i32* %4
%22 = icmp slt i32 %20, %21
br i1 %22, label %23, label %65
23: ; preds = %19
%24 = load i8**, i8*** %5
%25 = load i32, i32* %8
%26 = sext i32 %25 to i64
%27 = getelementptr inbounds i8*, i8** %24, i64 %26
%28 = load i8*, i8** %27
%29 = getelementptr inbounds i8, i8* %28, i64 0
%30 = load i8, i8* %29
%31 = sext i8 %30 to i32
%32 = icmp eq i32 %31, 45
br i1 %32, label %33, label %60
33: ; preds = %23
%34 = load i32, i32* %8
%35 = add nsw i32 %34, 1
store i32 %35, i32* %7
%36 = load i8**, i8*** %5
%37 = load i32, i32* %8
%38 = sext i32 %37 to i64
%39 = getelementptr inbounds i8*, i8** %36, i64 %38
%40 = load i8*, i8** %39
%41 = call i64 @strncmp(i8* %40, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0), i32 7)
%42 = icmp eq i64 %41, 0
br i1 %42, label %43, label %50
43: ; preds = %33
%44 = load i8**, i8*** %5
%45 = load i32, i32* %8
%46 = sext i32 %45 to i64
%47 = getelementptr inbounds i8*, i8** %44, i64 %46
%48 = load i8*, i8** %47
%49 = getelementptr inbounds i8, i8* %48, i64 7
store i8* %49, i8** %6
br label %59
50: ; preds = %33
%51 = load i32, i32* @stderr
%52 = load i8**, i8*** %5
%53 = load i32, i32* %8
%54 = sext i32 %53 to i64
%55 = getelementptr inbounds i8*, i8** %52, i64 %54
%56 = load i8*, i8** %55
%57 = call i32 @fprintf(i32 %51, i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.2, i64 0, i64 0), i8* %56)
%58 = call i32 @exit(i32 1)
unreachable
59: ; preds = %43
br label %61
60: ; preds = %23
br label %65
61: ; preds = %59
br label %62
62: ; preds = %61
%63 = load i32, i32* %8
%64 = add nsw i32 %63, 1
store i32 %64, i32* %8
br label %19
65: ; preds = %60, %19
%66 = call i64 @setuid(i32 0)
%67 = icmp eq i64 %66, 0
br i1 %67, label %68, label %94
68: ; preds = %65
%69 = call i64 @setgid(i32 0)
%70 = icmp eq i64 %69, 0
br i1 %70, label %71, label %94
71: ; preds = %68
%72 = load i8*, i8** %6
%73 = icmp ne i8* %72, null
br i1 %73, label %74, label %82
74: ; preds = %71
%75 = load i8*, i8** %6
%76 = call i64 @chdir(i8* %75)
%77 = icmp ne i64 %76, 0
br i1 %77, label %78, label %81
78: ; preds = %74
%79 = call i32 @perror(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.3, i64 0, i64 0))
%80 = call i32 @exit(i32 1)
unreachable
81: ; preds = %74
br label %82
82: ; preds = %81, %71
%83 = load i8**, i8*** %5
%84 = load i32, i32* %7
%85 = sext i32 %84 to i64
%86 = getelementptr inbounds i8*, i8** %83, i64 %85
%87 = load i8*, i8** %86
%88 = load i8**, i8*** %5
%89 = load i32, i32* %7
%90 = sext i32 %89 to i64
%91 = getelementptr inbounds i8*, i8** %88, i64 %90
%92 = call i32 @execve(i8* %87, i8** %91, i32* null)
%93 = call i32 @perror(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.4, i64 0, i64 0))
br label %96
94: ; preds = %68, %65
%95 = call i32 @perror(i8* getelementptr inbounds ([97 x i8], [97 x i8]* @.str.5, i64 0, i64 0))
br label %96
96: ; preds = %94, %82
ret i32 1
}

LLVM IR (-O2):
@stderr = global i32 0
@.str = [55 x i8] c"Usage: %s {-chdir=Directory} [Program] {Argument} ...\0A\00"
@.str.1 = [8 x i8] c"-chdir=\00"
@.str.2 = [28 x i8] c"ERROR: Bad parameter \22%s\22.\0A\00"
@.str.3 = [27 x i8] c"Unable to change directory\00"
@.str.4 = [24 x i8] c"Unable to start program\00"
@.str.5 = [97 x i8] c"Unable obtain root permissions. Ensure that rootshell is owned by root and has setuid set! Error\00"
define i32 @main(i32 %0, i8** %1) {
%3 = icmp slt i32 %0, 2
br i1 %3, label %10, label %4
4: ; preds = %2
%5 = zext i32 %0 to i64
%6 = getelementptr inbounds i8*, i8** %1, i64 1
%7 = load i8*, i8** %6
%8 = load i8, i8* %7
%9 = icmp eq i8 %8, 45
br i1 %9, label %20, label %40
10: ; preds = %2
%11 = load i32, i32* @stderr
%12 = load i8*, i8** %1
%13 = tail call i32 @fprintf(i32 %11, i8* getelementptr inbounds ([55 x i8], [55 x i8]* @.str, i64 0, i64 0), i8* %12)
%14 = tail call i32 @exit(i32 1)
unreachable
15: ; preds = %26
%16 = getelementptr inbounds i8*, i8** %1, i64 %27
%17 = load i8*, i8** %16
%18 = load i8, i8* %17
%19 = icmp eq i8 %18, 45
br i1 %19, label %20, label %35
20: ; preds = %4, %15
%21 = phi i8* [ %17, %15 ], [ %7, %4 ]
%22 = phi i8** [ %16, %15 ], [ %6, %4 ]
%23 = phi i64 [ %27, %15 ], [ 1, %4 ]
%24 = tail call i64 @strncmp(i8* %21, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0), i32 7)
%25 = icmp eq i64 %24, 0
br i1 %25, label %26, label %30
26: ; preds = %20
%27 = add nuw nsw i64 %23, 1
%28 = load i8*, i8** %22
%29 = icmp eq i64 %27, %5
br i1 %29, label %38, label %15
30: ; preds = %20
%31 = load i32, i32* @stderr
%32 = load i8*, i8** %22
%33 = tail call i32 @fprintf(i32 %31, i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.2, i64 0, i64 0), i8* %32)
%34 = tail call i32 @exit(i32 1)
unreachable
35: ; preds = %15
%36 = getelementptr inbounds i8, i8* %28, i64 7
%37 = trunc i64 %27 to i32
br label %40
38: ; preds = %26
%39 = getelementptr inbounds i8, i8* %28, i64 7
br label %40
40: ; preds = %38, %4, %35
%41 = phi i8* [ %36, %35 ], [ null, %4 ], [ %39, %38 ]
%42 = phi i32 [ %37, %35 ], [ 1, %4 ], [ %0, %38 ]
%43 = tail call i64 @setuid(i32 0)
%44 = icmp eq i64 %43, 0
br i1 %44, label %45, label %61
45: ; preds = %40
%46 = tail call i64 @setgid(i32 0)
%47 = icmp eq i64 %46, 0
br i1 %47, label %48, label %61
48: ; preds = %45
%49 = icmp eq i8* %41, null
br i1 %49, label %56, label %50
50: ; preds = %48
%51 = tail call i64 @chdir(i8* %41)
%52 = icmp eq i64 %51, 0
br i1 %52, label %56, label %53
53: ; preds = %50
%54 = tail call i32 @perror(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.3, i64 0, i64 0))
%55 = tail call i32 @exit(i32 1)
unreachable
56: ; preds = %50, %48
%57 = zext i32 %42 to i64
%58 = getelementptr inbounds i8*, i8** %1, i64 %57
%59 = load i8*, i8** %58
%60 = tail call i32 @execve(i8* %59, i8** %58, i32* null)
br label %61
61: ; preds = %40, %45, %56
%62 = phi i8* [ getelementptr inbounds ([24 x i8], [24 x i8]* @.str.4, i64 0, i64 0), %56 ], [ getelementptr inbounds ([97 x i8], [97 x i8]* @.str.5, i64 0, i64 0), %45 ], [ getelementptr inbounds ([97 x i8], [97 x i8]* @.str.5, i64 0, i64 0), %40 ]
%63 = tail call i32 @perror(i8* %62)
ret i32 1
}