#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int MAP_ANONYMOUS;
int MAP_PRIVATE;
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ _exit(int);
int /*<<< orphan*/ fgets(unsigned char *, int, int /*<<< orphan*/);
int getpagesize();
int /*<<< orphan*/ memset(unsigned char *, int /*<<< orphan*/, int);
unsigned char *mmap(int /*<<< orphan*/, int, int, int, int, int /*<<< orphan*/);
int /*<<< orphan*/ puts(char *);
int /*<<< orphan*/ setbuf(int /*<<< orphan*/, int /*<<< orphan*/ *);
int /*<<< orphan*/ stdin;
int /*<<< orphan*/ stdout;
int main() {
  setbuf(stdout, NULL);
  unsigned char seen[257], *p, *buf;
  void (*f)(void);
  memset(seen, 0, sizeof seen);
  buf = mmap(0, (0x4096 & ~(getpagesize() - 1)),
             PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS,
             -1, 0);
  puts("Shellcode?");
  fgets(buf, (0x4096 & ~(getpagesize() - 1)), stdin);
  for (p = buf; *p != '\n'; p++) {
    seen[256] += !seen[*p];
    seen[*p] |= 1;
  }
  if (seen[256] > 7) {
    puts("Shellcode too diverse.");
    _exit(1);
  } else {
    *(void **)(&f) = (void *)buf;
    f();
    _exit(0);
  }
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x130,%rsp
movl   $0x0,-0x4(%rbp)
mov    0x2e2f(%rip),%rax
mov    (%rax),%edi
xor    %eax,%eax
mov    %eax,%esi
call   1060 <setbuf@plt>
lea    -0x110(%rbp),%rdi
xor    %esi,%esi
mov    $0x101,%edx
call   1070 <memset@plt>
mov    $0x0,%al
call   1090 <getpagesize@plt>
mov    %eax,%esi
sub    $0x1,%esi
xor    $0xffffffff,%esi
and    $0x4096,%esi
mov    0x2e35(%rip),%rax
mov    (%rax),%edx
mov    0x2df4(%rip),%rax
or     (%rax),%edx
mov    0x2dfb(%rip),%rax
or     (%rax),%edx
mov    0x2dd2(%rip),%rax
mov    (%rax),%ecx
mov    0x2df1(%rip),%rax
or     (%rax),%ecx
xor    %r9d,%r9d
mov    $0xffffffff,%r8d
mov    %r9d,%edi
call   1050 <mmap@plt>
mov    %rax,-0x120(%rbp)
lea    0xdf8(%rip),%rdi
call   1040 <puts@plt>
mov    -0x120(%rbp),%rax
mov    %rax,-0x130(%rbp)
mov    $0x0,%al
call   1090 <getpagesize@plt>
mov    -0x130(%rbp),%rdi
mov    %eax,%esi
sub    $0x1,%esi
xor    $0xffffffff,%esi
and    $0x4096,%esi
mov    0x2da2(%rip),%rax
mov    (%rax),%edx
call   1080 <fgets@plt>
mov    -0x120(%rbp),%rax
mov    %rax,-0x118(%rbp)
mov    -0x118(%rbp),%rax
movzbl (%rax),%eax
cmp    $0xa,%eax
je     12be <main+0x14e>
mov    -0x118(%rbp),%rax
movzbl (%rax),%eax
cmpb   $0x0,-0x110(%rbp,%rax,1)
setne  %al
xor    $0xff,%al
and    $0x1,%al
movzbl %al,%ecx
movzbl -0x10(%rbp),%eax
add    %ecx,%eax
mov    %al,-0x10(%rbp)
mov    -0x118(%rbp),%rax
movzbl (%rax),%eax
movzbl -0x110(%rbp,%rax,1),%ecx
ff
or     $0x1,%ecx
mov    %cl,-0x110(%rbp,%rax,1)
mov    -0x118(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x118(%rbp)
jmp    1253 <main+0xe3>
movzbl -0x10(%rbp),%eax
cmp    $0x7,%eax
jle    12e1 <main+0x171>
lea    0xd39(%rip),%rdi
call   1040 <puts@plt>
mov    $0x1,%edi
call   1030 <_exit@plt>
mov    -0x120(%rbp),%rax
mov    %rax,-0x128(%rbp)
call   *-0x128(%rbp)
xor    %edi,%edi
call   1030 <_exit@plt>

x86 assembly (clang, -O2):
<main>:
push   %rbx
sub    $0x110,%rsp
mov    0x2e39(%rip),%rax
mov    (%rax),%edi
xor    %esi,%esi
call   1060 <setbuf@plt>
mov    %rsp,%rdi
xor    %esi,%esi
mov    $0x101,%edx
call   1070 <memset@plt>
xor    %eax,%eax
call   1090 <getpagesize@plt>
neg    %eax
and    $0x4096,%eax
mov    0x2e4c(%rip),%rcx
mov    0x2e0d(%rip),%rdx
mov    (%rdx),%edx
or     (%rcx),%edx
mov    0x2e12(%rip),%rcx
or     (%rcx),%edx
mov    0x2de9(%rip),%rsi
mov    0x2e0a(%rip),%rcx
mov    (%rcx),%ecx
or     (%rsi),%ecx
xor    %edi,%edi
mov    %eax,%esi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1050 <mmap@plt>
mov    %rax,%rbx
lea    0xe12(%rip),%rdi
call   1040 <puts@plt>
xor    %eax,%eax
call   1090 <getpagesize@plt>
neg    %eax
and    $0x4096,%eax
mov    0x2dd8(%rip),%rcx
mov    (%rcx),%edx
mov    %rbx,%rdi
mov    %eax,%esi
call   1080 <fgets@plt>
mov    (%rbx),%dl
mov    0x100(%rsp),%al
cmp    $0xa,%dl
je     1254 <main+0xe4>
lea    0x1(%rbx),%rcx
cs nopw 0x0(%rax,%rax,1)
movzbl %dl,%edx
cmpb   $0x1,(%rsp,%rdx,1)
adc    $0x0,%al
mov    %al,0x100(%rsp)
movzbl -0x1(%rcx),%edx
orb    $0x1,(%rsp,%rdx,1)
movzbl (%rcx),%edx
add    $0x1,%rcx
cmp    $0xa,%dl
jne    1230 <main+0xc0>
cmp    $0x8,%al
jb     126e <main+0xfe>
lea    0xdac(%rip),%rdi
call   1040 <puts@plt>
mov    $0x1,%edi
call   1030 <_exit@plt>
call   *%rbx
xor    %edi,%edi
call   1030 <_exit@plt>

LLVM IR (-O0):
@stdout = global i32 0
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@.str = [11 x i8] c"Shellcode?\00"
@stdin = global i32 0
@.str.1 = [23 x i8] c"Shellcode too diverse.\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [257 x i8]
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca void ()*
store i32 0, i32* %1
%6 = load i32, i32* @stdout
%7 = call i32 @setbuf(i32 %6, i32* null)
%8 = getelementptr inbounds [257 x i8], [257 x i8]* %2, i64 0, i64 0
%9 = call i32 @memset(i8* %8, i32 0, i32 257)
%10 = call i32 (...) @getpagesize()
%11 = sub nsw i32 %10, 1
%12 = xor i32 %11, -1
%13 = and i32 16534, %12
%14 = load i32, i32* @PROT_READ
%15 = load i32, i32* @PROT_WRITE
%16 = or i32 %14, %15
%17 = load i32, i32* @PROT_EXEC
%18 = or i32 %16, %17
%19 = load i32, i32* @MAP_PRIVATE
%20 = load i32, i32* @MAP_ANONYMOUS
%21 = or i32 %19, %20
%22 = call i8* @mmap(i32 0, i32 %13, i32 %18, i32 %21, i32 -1, i32 0)
store i8* %22, i8** %4
%23 = call i32 @puts(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0))
%24 = load i8*, i8** %4
%25 = call i32 (...) @getpagesize()
%26 = sub nsw i32 %25, 1
%27 = xor i32 %26, -1
%28 = and i32 16534, %27
%29 = load i32, i32* @stdin
%30 = call i32 @fgets(i8* %24, i32 %28, i32 %29)
%31 = load i8*, i8** %4
store i8* %31, i8** %3
br label %32
32: ; preds = %59, %0
%33 = load i8*, i8** %3
%34 = load i8, i8* %33
%35 = zext i8 %34 to i32
%36 = icmp ne i32 %35, 10
br i1 %36, label %37, label %62
37: ; preds = %32
%38 = load i8*, i8** %3
%39 = load i8, i8* %38
%40 = zext i8 %39 to i64
%41 = getelementptr inbounds [257 x i8], [257 x i8]* %2, i64 0, i64 %40
%42 = load i8, i8* %41
%43 = icmp ne i8 %42, 0
%44 = xor i1 %43, true
%45 = zext i1 %44 to i32
%46 = getelementptr inbounds [257 x i8], [257 x i8]* %2, i64 0, i64 256
%47 = load i8, i8* %46
%48 = zext i8 %47 to i32
%49 = add nsw i32 %48, %45
%50 = trunc i32 %49 to i8
store i8 %50, i8* %46
%51 = load i8*, i8** %3
%52 = load i8, i8* %51
%53 = zext i8 %52 to i64
%54 = getelementptr inbounds [257 x i8], [257 x i8]* %2, i64 0, i64 %53
%55 = load i8, i8* %54
%56 = zext i8 %55 to i32
%57 = or i32 %56, 1
%58 = trunc i32 %57 to i8
store i8 %58, i8* %54
br label %59
59: ; preds = %37
%60 = load i8*, i8** %3
%61 = getelementptr inbounds i8, i8* %60, i32 1
store i8* %61, i8** %3
br label %32
62: ; preds = %32
%63 = getelementptr inbounds [257 x i8], [257 x i8]* %2, i64 0, i64 256
%64 = load i8, i8* %63
%65 = zext i8 %64 to i32
%66 = icmp sgt i32 %65, 7
br i1 %66, label %67, label %70
67: ; preds = %62
%68 = call i32 @puts(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.1, i64 0, i64 0))
%69 = call i32 @_exit(i32 1)
unreachable
70: ; preds = %62
%71 = load i8*, i8** %4
%72 = bitcast void ()** %5 to i8**
store i8* %71, i8** %72
%73 = load void ()*, void ()** %5
%74 = call i32 @_exit(i32 0)
unreachable
}

LLVM IR (-O2):
@stdout = global i32 0
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@.str = [11 x i8] c"Shellcode?\00"
@stdin = global i32 0
@.str.1 = [23 x i8] c"Shellcode too diverse.\00"
define i32 @main() {
%1 = alloca [257 x i8]
%2 = load i32, i32* @stdout
%3 = tail call i32 @setbuf(i32 %2, i32* null)
%4 = getelementptr inbounds [257 x i8], [257 x i8]* %1, i64 0, i64 0
%5 = call i32 @memset(i8* %4, i32 0, i32 257)
%6 = call i32 (...) @getpagesize()
%7 = sub i32 0, %6
%8 = and i32 %7, 16534
%9 = load i32, i32* @PROT_READ
%10 = load i32, i32* @PROT_WRITE
%11 = or i32 %10, %9
%12 = load i32, i32* @PROT_EXEC
%13 = or i32 %11, %12
%14 = load i32, i32* @MAP_PRIVATE
%15 = load i32, i32* @MAP_ANONYMOUS
%16 = or i32 %15, %14
%17 = call i8* @mmap(i32 0, i32 %8, i32 %13, i32 %16, i32 -1, i32 0)
%18 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0))
%19 = call i32 (...) @getpagesize()
%20 = sub i32 0, %19
%21 = and i32 %20, 16534
%22 = load i32, i32* @stdin
%23 = call i32 @fgets(i8* %17, i32 %21, i32 %22)
%24 = load i8, i8* %17
%25 = icmp eq i8 %24, 10
%26 = getelementptr inbounds [257 x i8], [257 x i8]* %1, i64 0, i64 256
%27 = load i8, i8* %26
br i1 %25, label %46, label %28
28: ; preds = %0, %28
%29 = phi i8 [ %37, %28 ], [ %27, %0 ]
%30 = phi i8 [ %44, %28 ], [ %24, %0 ]
%31 = phi i8* [ %43, %28 ], [ %17, %0 ]
%32 = zext i8 %30 to i64
%33 = getelementptr inbounds [257 x i8], [257 x i8]* %1, i64 0, i64 %32
%34 = load i8, i8* %33
%35 = icmp eq i8 %34, 0
%36 = zext i1 %35 to i8
%37 = add i8 %29, %36
store i8 %37, i8* %26
%38 = load i8, i8* %31
%39 = zext i8 %38 to i64
%40 = getelementptr inbounds [257 x i8], [257 x i8]* %1, i64 0, i64 %39
%41 = load i8, i8* %40
%42 = or i8 %41, 1
store i8 %42, i8* %40
%43 = getelementptr inbounds i8, i8* %31, i64 1
%44 = load i8, i8* %43
%45 = icmp eq i8 %44, 10
br i1 %45, label %46, label %28
46: ; preds = %28, %0
%47 = phi i8 [ %27, %0 ], [ %37, %28 ]
%48 = icmp ugt i8 %47, 7
br i1 %48, label %49, label %52
49: ; preds = %46
%50 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.1, i64 0, i64 0))
%51 = call i32 @_exit(i32 1)
unreachable
52: ; preds = %46
%53 = bitcast i8* %17 to void ()*
%54 = call i32 @_exit(i32 0)
unreachable
}