#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ geteuid();
int /*<<< orphan*/ printf(char *);
int /*<<< orphan*/ setuid(int /*<<< orphan*/);
int /*<<< orphan*/ sprintf(char *, char *, char *, char *, ...);
int /*<<< orphan*/ system(char *);
int main(int argc, char *argv[]) {
  if (!setuid(geteuid())) {
    char str[100];
    if (argc == 3) {
      sprintf(str, "/bin/echo '%s %s > /dev/null 2>&1' | /usr/bin/at now",
              argv[1], argv[2]);
    }
    if (argc == 4) {
      sprintf(str, "/bin/echo '%s %s %s > /dev/null 2>&1' | /usr/bin/at now",
              argv[1], argv[2], argv[3]);
    }
    if (argc == 5) {
      sprintf(str, "/bin/echo '%s %s %s %s > /dev/null 2>&1' | /usr/bin/at now",
              argv[1], argv[2], argv[3], argv[4]);
    }
    if (argc == 6) {
      sprintf(str,
              "/bin/echo '%s %s %s %s %s > /dev/null 2>&1' | /usr/bin/at now",
              argv[1], argv[2], argv[3], argv[4], argv[5]);
    }
    system(str);
  } else {
    printf("Couldn't set UID to effective UID\n");
    return 1;
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    $0x0,%al
call   1050 <geteuid@plt>
mov    %eax,%edi
call   1070 <setuid@plt>
cmp    $0x0,%eax
jne    1272 <main+0x122>
cmpl   $0x3,-0x8(%rbp)
jne    11ac <main+0x5c>
lea    -0x80(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdx
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rcx
lea    0xe5b(%rip),%rsi
mov    $0x0,%al
call   1060 <sprintf@plt>
cmpl   $0x4,-0x8(%rbp)
jne    11e0 <main+0x90>
lea    -0x80(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdx
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rcx
mov    -0x10(%rbp),%rax
mov    0x18(%rax),%r8
lea    0xe5c(%rip),%rsi
mov    $0x0,%al
call   1060 <sprintf@plt>
cmpl   $0x5,-0x8(%rbp)
jne    121c <main+0xcc>
lea    -0x80(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdx
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rcx
mov    -0x10(%rbp),%rax
mov    0x18(%rax),%r8
mov    -0x10(%rbp),%rax
mov    0x20(%rax),%r9
lea    0xe58(%rip),%rsi
mov    $0x0,%al
call   1060 <sprintf@plt>
cmpl   $0x6,-0x8(%rbp)
jne    1264 <main+0x114>
lea    -0x80(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdx
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rcx
mov    -0x10(%rbp),%rax
mov    0x18(%rax),%r8
mov    -0x10(%rbp),%rax
mov    0x20(%rax),%r9
mov    -0x10(%rbp),%rax
mov    0x28(%rax),%rax
lea    0xe4f(%rip),%rsi
mov    %rax,(%rsp)
mov    $0x0,%al
call   1060 <sprintf@plt>
lea    -0x80(%rbp),%rdi
call   1030 <system@plt>
jmp    128a <main+0x13a>
lea    0xe6d(%rip),%rdi
call   1040 <printf@plt>
movl   $0x1,-0x4(%rbp)
jmp    1291 <main+0x141>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x90,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
sub    $0x78,%rsp
mov    %rsi,%r14
mov    %edi,%ebx
xor    %eax,%eax
call   1050 <geteuid@plt>
mov    %eax,%edi
call   1070 <setuid@plt>
test   %eax,%eax
je     1184 <main+0x34>
lea    0xf81(%rip),%rdi
call   1030 <puts@plt>
mov    $0x1,%eax
jmp    122e <main+0xde>
add    $0xfffffffd,%ebx
cmp    $0x3,%ebx
ja     1222 <main+0xd2>
lea    0xe69(%rip),%rax
movslq (%rax,%rbx,4),%rcx
add    %rax,%rcx
jmp    *%rcx
mov    0x8(%r14),%rdx
mov    0x10(%r14),%rcx
lea    0xe61(%rip),%rsi
lea    0x10(%rsp),%rdi
xor    %eax,%eax
call   1060 <sprintf@plt>
jmp    1222 <main+0xd2>
mov    0x8(%r14),%rdx
mov    0x10(%r14),%rcx
mov    0x18(%r14),%r8
lea    0xe75(%rip),%rsi
lea    0x10(%rsp),%rdi
xor    %eax,%eax
call   1060 <sprintf@plt>
jmp    1222 <main+0xd2>
mov    0x8(%r14),%rdx
mov    0x10(%r14),%rcx
mov    0x18(%r14),%r8
mov    0x20(%r14),%r9
lea    0xe88(%rip),%rsi
jmp    1216 <main+0xc6>
mov    0x8(%r14),%rdx
mov    0x10(%r14),%rcx
mov    0x18(%r14),%r8
mov    0x20(%r14),%r9
mov    0x28(%r14),%rax
mov    %rax,(%rsp)
lea    0xea2(%rip),%rsi
lea    0x10(%rsp),%rdi
xor    %eax,%eax
call   1060 <sprintf@plt>
lea    0x10(%rsp),%rdi
call   1040 <system@plt>
xor    %eax,%eax
add    $0x78,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@.str = [53 x i8] c"/bin/echo '%s %s > /dev/null 2>&1' | /usr/bin/at now\00"
@.str.1 = [56 x i8] c"/bin/echo '%s %s %s > /dev/null 2>&1' | /usr/bin/at now\00"
@.str.2 = [59 x i8] c"/bin/echo '%s %s %s %s > /dev/null 2>&1' | /usr/bin/at now\00"
@.str.3 = [62 x i8] c"/bin/echo '%s %s %s %s %s > /dev/null 2>&1' | /usr/bin/at now\00"
@.str.4 = [35 x i8] c"Couldn't set UID to effective UID\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca [100 x i8]
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%7 = call i32 (...) @geteuid()
%8 = call i32 @setuid(i32 %7)
%9 = icmp ne i32 %8, 0
br i1 %9, label %79, label %10
10: ; preds = %2
%11 = load i32, i32* %4
%12 = icmp eq i32 %11, 3
br i1 %12, label %13, label %22
13: ; preds = %10
%14 = getelementptr inbounds [100 x i8], [100 x i8]* %6, i64 0, i64 0
%15 = load i8**, i8*** %5
%16 = getelementptr inbounds i8*, i8** %15, i64 1
%17 = load i8*, i8** %16
%18 = load i8**, i8*** %5
%19 = getelementptr inbounds i8*, i8** %18, i64 2
%20 = load i8*, i8** %19
%21 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %14, i8* getelementptr inbounds ([53 x i8], [53 x i8]* @.str, i64 0, i64 0), i8* %17, i8* %20)
br label %22
22: ; preds = %13, %10
%23 = load i32, i32* %4
%24 = icmp eq i32 %23, 4
br i1 %24, label %25, label %37
25: ; preds = %22
%26 = getelementptr inbounds [100 x i8], [100 x i8]* %6, i64 0, i64 0
%27 = load i8**, i8*** %5
%28 = getelementptr inbounds i8*, i8** %27, i64 1
%29 = load i8*, i8** %28
%30 = load i8**, i8*** %5
%31 = getelementptr inbounds i8*, i8** %30, i64 2
%32 = load i8*, i8** %31
%33 = load i8**, i8*** %5
%34 = getelementptr inbounds i8*, i8** %33, i64 3
%35 = load i8*, i8** %34
%36 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %26, i8* getelementptr inbounds ([56 x i8], [56 x i8]* @.str.1, i64 0, i64 0), i8* %29, i8* %32, i8* %35)
br label %37
37: ; preds = %25, %22
%38 = load i32, i32* %4
%39 = icmp eq i32 %38, 5
br i1 %39, label %40, label %55
40: ; preds = %37
%41 = getelementptr inbounds [100 x i8], [100 x i8]* %6, i64 0, i64 0
%42 = load i8**, i8*** %5
%43 = getelementptr inbounds i8*, i8** %42, i64 1
%44 = load i8*, i8** %43
%45 = load i8**, i8*** %5
%46 = getelementptr inbounds i8*, i8** %45, i64 2
%47 = load i8*, i8** %46
%48 = load i8**, i8*** %5
%49 = getelementptr inbounds i8*, i8** %48, i64 3
%50 = load i8*, i8** %49
%51 = load i8**, i8*** %5
%52 = getelementptr inbounds i8*, i8** %51, i64 4
%53 = load i8*, i8** %52
%54 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %41, i8* getelementptr inbounds ([59 x i8], [59 x i8]* @.str.2, i64 0, i64 0), i8* %44, i8* %47, i8* %50, i8* %53)
br label %55
55: ; preds = %40, %37
%56 = load i32, i32* %4
%57 = icmp eq i32 %56, 6
br i1 %57, label %58, label %76
58: ; preds = %55
%59 = getelementptr inbounds [100 x i8], [100 x i8]* %6, i64 0, i64 0
%60 = load i8**, i8*** %5
%61 = getelementptr inbounds i8*, i8** %60, i64 1
%62 = load i8*, i8** %61
%63 = load i8**, i8*** %5
%64 = getelementptr inbounds i8*, i8** %63, i64 2
%65 = load i8*, i8** %64
%66 = load i8**, i8*** %5
%67 = getelementptr inbounds i8*, i8** %66, i64 3
%68 = load i8*, i8** %67
%69 = load i8**, i8*** %5
%70 = getelementptr inbounds i8*, i8** %69, i64 4
%71 = load i8*, i8** %70
%72 = load i8**, i8*** %5
%73 = getelementptr inbounds i8*, i8** %72, i64 5
%74 = load i8*, i8** %73
%75 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %59, i8* getelementptr inbounds ([62 x i8], [62 x i8]* @.str.3, i64 0, i64 0), i8* %62, i8* %65, i8* %68, i8* %71, i8* %74)
br label %76
76: ; preds = %58, %55
%77 = getelementptr inbounds [100 x i8], [100 x i8]* %6, i64 0, i64 0
%78 = call i32 @system(i8* %77)
br label %81
79: ; preds = %2
%80 = call i32 @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.4, i64 0, i64 0))
store i32 1, i32* %3
br label %82
81: ; preds = %76
store i32 0, i32* %3
br label %82
82: ; preds = %81, %79
%83 = load i32, i32* %3
ret i32 %83
}

LLVM IR (-O2):
@.str = [53 x i8] c"/bin/echo '%s %s > /dev/null 2>&1' | /usr/bin/at now\00"
@.str.1 = [56 x i8] c"/bin/echo '%s %s %s > /dev/null 2>&1' | /usr/bin/at now\00"
@.str.2 = [59 x i8] c"/bin/echo '%s %s %s %s > /dev/null 2>&1' | /usr/bin/at now\00"
@.str.3 = [62 x i8] c"/bin/echo '%s %s %s %s %s > /dev/null 2>&1' | /usr/bin/at now\00"
@str = [34 x i8] c"Couldn't set UID to effective UID\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca [100 x i8]
%4 = tail call i32 (...) @geteuid()
%5 = tail call i32 @setuid(i32 %4)
%6 = icmp eq i32 %5, 0
br i1 %6, label %7, label %47
7: ; preds = %2
%8 = getelementptr inbounds [100 x i8], [100 x i8]* %3, i64 0, i64 0
switch i32 %0, label %45 [
i32 3, label %9
i32 4, label %15
i32 5, label %23
i32 6, label %33
]
9: ; preds = %7
%10 = getelementptr inbounds i8*, i8** %1, i64 1
%11 = load i8*, i8** %10
%12 = getelementptr inbounds i8*, i8** %1, i64 2
%13 = load i8*, i8** %12
%14 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %8, i8* dereferenceable(1) getelementptr inbounds ([53 x i8], [53 x i8]* @.str, i64 0, i64 0), i8* %11, i8* %13)
br label %45
15: ; preds = %7
%16 = getelementptr inbounds i8*, i8** %1, i64 1
%17 = load i8*, i8** %16
%18 = getelementptr inbounds i8*, i8** %1, i64 2
%19 = load i8*, i8** %18
%20 = getelementptr inbounds i8*, i8** %1, i64 3
%21 = load i8*, i8** %20
%22 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %8, i8* dereferenceable(1) getelementptr inbounds ([56 x i8], [56 x i8]* @.str.1, i64 0, i64 0), i8* %17, i8* %19, i8* %21)
br label %45
23: ; preds = %7
%24 = getelementptr inbounds i8*, i8** %1, i64 1
%25 = load i8*, i8** %24
%26 = getelementptr inbounds i8*, i8** %1, i64 2
%27 = load i8*, i8** %26
%28 = getelementptr inbounds i8*, i8** %1, i64 3
%29 = load i8*, i8** %28
%30 = getelementptr inbounds i8*, i8** %1, i64 4
%31 = load i8*, i8** %30
%32 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %8, i8* dereferenceable(1) getelementptr inbounds ([59 x i8], [59 x i8]* @.str.2, i64 0, i64 0), i8* %25, i8* %27, i8* %29, i8* %31)
br label %45
33: ; preds = %7
%34 = getelementptr inbounds i8*, i8** %1, i64 1
%35 = load i8*, i8** %34
%36 = getelementptr inbounds i8*, i8** %1, i64 2
%37 = load i8*, i8** %36
%38 = getelementptr inbounds i8*, i8** %1, i64 3
%39 = load i8*, i8** %38
%40 = getelementptr inbounds i8*, i8** %1, i64 4
%41 = load i8*, i8** %40
%42 = getelementptr inbounds i8*, i8** %1, i64 5
%43 = load i8*, i8** %42
%44 = call i32 (i8*, i8*, i8*, i8*, ...) @sprintf(i8* %8, i8* dereferenceable(1) getelementptr inbounds ([62 x i8], [62 x i8]* @.str.3, i64 0, i64 0), i8* %35, i8* %37, i8* %39, i8* %41, i8* %43)
br label %45
45: ; preds = %23, %15, %9, %7, %33
%46 = call i32 @system(i8* %8)
br label %49
47: ; preds = %2
%48 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([34 x i8], [34 x i8]* @str, i64 0, i64 0))
br label %49
49: ; preds = %45, %47
%50 = phi i32 [ 1, %47 ], [ 0, %45 ]
ret i32 %50
}