#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ exit(int);
int login();
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ setbuf(int /*<<< orphan*/, int /*<<< orphan*/ *);
int /*<<< orphan*/ stdout;
int /*<<< orphan*/ system(char *);
int main(int argc, char **argv) {
  setbuf(stdout, NULL);
  printf("+----------------------------------------+\n"
         "|                                        |\n"
         "|                                        |\n"
         "|                                        |\n"
         "|                                        |\n"
         "|  Welcome to the VR gear admin console  |\n"
         "|                                        |\n"
         "|                                        |\n"
         "|                                        |\n"
         "|                                        |\n"
         "+----------------------------------------+\n"
         "|                                        |\n"
         "|      Your account is not recognized    |\n"
         "|                                        |\n"
         "+----------------------------------------+\n"
         "\n\n\n\n"
         "Please login to continue...\n\n\n");
  int access = login();
  printf("Your access level is: 0x%08x\n", access);
  if (access >= 0xff || access <= 0) {
    printf("Login unsuccessful.\n");
    exit(10);
  } else if (access < 0x30) {
    printf("Admin access granted!\n");
    printf("The flag is in \"flag.txt\".\n");
    system("/bin/sh");
  } else {
    printf("Login successful.\n");
    printf("You do not have permission to access this resource.\n");
    exit(1);
  }
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %edi,-0x4(%rbp)
mov    %rsi,-0x10(%rbp)
mov    0x2e7a(%rip),%rax
mov    (%rax),%edi
xor    %eax,%eax
mov    %eax,%esi
call   1030 <setbuf@plt>
lea    0xe88(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0x0,%al
call   1060 <login@plt>
mov    %eax,-0x14(%rbp)
mov    -0x14(%rbp),%esi
lea    0x1115(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
cmpl   $0xff,-0x14(%rbp)
jge    11b1 <main+0x61>
cmpl   $0x0,-0x14(%rbp)
jg     11c9 <main+0x79>
lea    0x110e(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0xa,%edi
call   1070 <exit@plt>
cmpl   $0x30,-0x14(%rbp)
jge    1200 <main+0xb0>
lea    0x1101(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0x110a(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0x1118(%rip),%rdi
call   1040 <system@plt>
jmp    1226 <main+0xd6>
lea    0x110f(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0x1114(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0x1,%edi
call   1070 <exit@plt>
jmp    122b <main+0xdb>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
mov    0x2e78(%rip),%rax
mov    (%rax),%edi
xor    %esi,%esi
call   1040 <setbuf@plt>
lea    0xeae(%rip),%rdi
call   1030 <puts@plt>
xor    %eax,%eax
call   1070 <login@plt>
mov    %eax,%ebx
lea    0xe73(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1060 <printf@plt>
lea    -0xff(%rbx),%eax
cmp    $0xffffff01,%eax
jbe    11d0 <main+0x70>
cmp    $0x2f,%ebx
ja     11e6 <main+0x86>
lea    0x1164(%rip),%rdi
call   1030 <puts@plt>
lea    0x116e(%rip),%rdi
call   1030 <puts@plt>
lea    0xe57(%rip),%rdi
call   1050 <system@plt>
xor    %eax,%eax
pop    %rbx
ret
lea    0x116d(%rip),%rdi
call   1030 <puts@plt>
mov    $0xa,%edi
call   1080 <exit@plt>
lea    0x10e0(%rip),%rdi
call   1030 <puts@plt>
lea    0x10e6(%rip),%rdi
call   1030 <puts@plt>
mov    $0x1,%edi
call   1080 <exit@plt>

LLVM IR (-O0):
@stdout = global i32 0
@.str = [680 x i8] c"+----------------------------------------+\0A| |\0A| |\0A| |\0A| |\0A| Welcome to the VR gear admin console |\0A| |\0A| |\0A| |\0A| |\0A+----------------------------------------+\0A| |\0A| Your account is not recognized |\0A| |\0A+----------------------------------------+\0A\0A\0A\0A\0APlease login to continue...\0A\0A\0A\00"
@.str.1 = [30 x i8] c"Your access level is: 0x%08x\0A\00"
@.str.2 = [21 x i8] c"Login unsuccessful.\0A\00"
@.str.3 = [23 x i8] c"Admin access granted!\0A\00"
@.str.4 = [28 x i8] c"The flag is in \22flag.txt\22.\0A\00"
@.str.5 = [8 x i8] c"/bin/sh\00"
@.str.6 = [19 x i8] c"Login successful.\0A\00"
@.str.7 = [53 x i8] c"You do not have permission to access this resource.\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i8**
%5 = alloca i32
store i32 %0, i32* %3
store i8** %1, i8*** %4
%6 = load i32, i32* @stdout
%7 = call i32 @setbuf(i32 %6, i32* null)
%8 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([680 x i8], [680 x i8]* @.str, i64 0, i64 0))
%9 = call i32 (...) @login()
store i32 %9, i32* %5
%10 = load i32, i32* %5
%11 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.1, i64 0, i64 0), i32 %10)
%12 = load i32, i32* %5
%13 = icmp sge i32 %12, 255
br i1 %13, label %17, label %14
14: ; preds = %2
%15 = load i32, i32* %5
%16 = icmp sle i32 %15, 0
br i1 %16, label %17, label %20
17: ; preds = %14, %2
%18 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.2, i64 0, i64 0))
%19 = call i32 @exit(i32 10)
unreachable
20: ; preds = %14
%21 = load i32, i32* %5
%22 = icmp slt i32 %21, 48
br i1 %22, label %23, label %27
23: ; preds = %20
%24 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.3, i64 0, i64 0))
%25 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.4, i64 0, i64 0))
%26 = call i32 @system(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.5, i64 0, i64 0))
br label %31
27: ; preds = %20
%28 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str.6, i64 0, i64 0))
%29 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([53 x i8], [53 x i8]* @.str.7, i64 0, i64 0))
%30 = call i32 @exit(i32 1)
unreachable
31: ; preds = %23
br label %32
32: ; preds = %31
ret i32 0
}

LLVM IR (-O2):
@stdout = global i32 0
@.str.1 = [30 x i8] c"Your access level is: 0x%08x\0A\00"
@.str.5 = [8 x i8] c"/bin/sh\00"
@str = [679 x i8] c"+----------------------------------------+\0A| |\0A| |\0A| |\0A| |\0A| Welcome to the VR gear admin console |\0A| |\0A| |\0A| |\0A| |\0A+----------------------------------------+\0A| |\0A| Your account is not recognized |\0A| |\0A+----------------------------------------+\0A\0A\0A\0A\0APlease login to continue...\0A\0A\00"
@str.8 = [18 x i8] c"Login successful.\00"
@str.9 = [52 x i8] c"You do not have permission to access this resource.\00"
@str.10 = [22 x i8] c"Admin access granted!\00"
@str.11 = [27 x i8] c"The flag is in \22flag.txt\22.\00"
@str.12 = [20 x i8] c"Login unsuccessful.\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = load i32, i32* @stdout
%4 = tail call i32 @setbuf(i32 %3, i32* null)
%5 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([679 x i8], [679 x i8]* @str, i64 0, i64 0))
%6 = tail call i32 (...) @login()
%7 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @.str.1, i64 0, i64 0), i32 %6)
%8 = add i32 %6, -255
%9 = icmp ult i32 %8, -254
br i1 %9, label %10, label %13
10: ; preds = %2
%11 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @str.12, i64 0, i64 0))
%12 = tail call i32 @exit(i32 10)
unreachable
13: ; preds = %2
%14 = icmp ult i32 %6, 48
br i1 %14, label %15, label %19
15: ; preds = %13
%16 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @str.10, i64 0, i64 0))
%17 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([27 x i8], [27 x i8]* @str.11, i64 0, i64 0))
%18 = tail call i32 @system(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.5, i64 0, i64 0))
ret i32 0
19: ; preds = %13
%20 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([18 x i8], [18 x i8]* @str.8, i64 0, i64 0))
%21 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([52 x i8], [52 x i8]* @str.9, i64 0, i64 0))
%22 = tail call i32 @exit(i32 1)
unreachable
}