#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ scanf(char *, char **);
int /*<<< orphan*/ system(char *);
int main() {
  long val = 0x41414141;
  char buf[20];
  printf("Correct val's value from 0x41414141 -> 0xdeadbeef!\n");
  printf("Here is your chance: ");
  scanf("%24s", &buf);
  printf("buf: %s\n", buf);
  printf("val: 0x%08x\n", val);
  if (val == 0xdeadbeef)
    system("/bin/sh");
  else {
    printf("WAY OFF!!!!\n");
    exit(1);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x41414141,-0x10(%rbp)
41
lea    0xea2(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    0xec8(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x30(%rbp),%rsi
lea    0xecc(%rip),%rdi
call   1050 <scanf@plt>
lea    -0x30(%rbp),%rsi
lea    0xec1(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x10(%rbp),%rsi
lea    0xeb8(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    $0xdeadbeef,%eax
cmp    %rax,-0x10(%rbp)
jne    11c7 <main+0x87>
lea    0xea8(%rip),%rdi
call   1030 <system@plt>
jmp    11df <main+0x9f>
lea    0xe9f(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    $0x1,%edi
call   1060 <exit@plt>
xor    %eax,%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
sub    $0x20,%rsp
lea    0xee5(%rip),%rdi
call   1030 <puts@plt>
lea    0xea8(%rip),%rdi
xor    %eax,%eax
call   1040 <printf@plt>
lea    0xeb0(%rip),%rdi
mov    %rsp,%rbx
mov    %rbx,%rsi
call   1050 <scanf@plt>
lea    0xea3(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
lea    0xe9b(%rip),%rdi
mov    $0x41414141,%esi
xor    %eax,%eax
call   1040 <printf@plt>
lea    0xec8(%rip),%rdi
call   1030 <puts@plt>
mov    $0x1,%edi
call   1060 <exit@plt>

LLVM IR (-O0):
@.str = [52 x i8] c"Correct val's value from 0x41414141 -> 0xdeadbeef!\0A\00"
@.str.1 = [22 x i8] c"Here is your chance: \00"
@.str.2 = [5 x i8] c"%24s\00"
@.str.3 = [9 x i8] c"buf: %s\0A\00"
@.str.4 = [13 x i8] c"val: 0x%08x\0A\00"
@.str.5 = [8 x i8] c"/bin/sh\00"
@.str.6 = [13 x i8] c"WAY OFF!!!!\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i64
%3 = alloca [20 x i8]
store i32 0, i32* %1
store i64 1094795585, i64* %2
%4 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([52 x i8], [52 x i8]* @.str, i64 0, i64 0))
%5 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.1, i64 0, i64 0))
%6 = bitcast [20 x i8]* %3 to i8**
%7 = call i32 @scanf(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0), i8** %6)
%8 = getelementptr inbounds [20 x i8], [20 x i8]* %3, i64 0, i64 0
%9 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i8* %8)
%10 = load i64, i64* %2
%11 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.4, i64 0, i64 0), i64 %10)
%12 = load i64, i64* %2
%13 = icmp eq i64 %12, 3735928559
br i1 %13, label %14, label %16
14: ; preds = %0
%15 = call i32 @system(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.5, i64 0, i64 0))
br label %19
16: ; preds = %0
%17 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.6, i64 0, i64 0))
%18 = call i32 @exit(i32 1)
unreachable
19: ; preds = %14
ret i32 0
}

LLVM IR (-O2):
@.str.1 = [22 x i8] c"Here is your chance: \00"
@.str.2 = [5 x i8] c"%24s\00"
@.str.3 = [9 x i8] c"buf: %s\0A\00"
@.str.4 = [13 x i8] c"val: 0x%08x\0A\00"
@str = [51 x i8] c"Correct val's value from 0x41414141 -> 0xdeadbeef!\00"
@str.7 = [12 x i8] c"WAY OFF!!!!\00"
define i32 @main() {
%1 = alloca [20 x i8]
%2 = getelementptr inbounds [20 x i8], [20 x i8]* %1, i64 0, i64 0
%3 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([51 x i8], [51 x i8]* @str, i64 0, i64 0))
%4 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @.str.1, i64 0, i64 0))
%5 = bitcast [20 x i8]* %1 to i8**
%6 = call i32 @scanf(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0), i8** %5)
%7 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i8* %2)
%8 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([13 x i8], [13 x i8]* @.str.4, i64 0, i64 0), i64 1094795585)
%9 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([12 x i8], [12 x i8]* @str.7, i64 0, i64 0))
%10 = call i32 @exit(i32 1)
unreachable
}