#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ buf;

/* Variables and functions */
unsigned int EOF;
int /*<<< orphan*/ execlp(char *, char *, char *, int /*<<< orphan*/ *);
unsigned int getchar();
int /*<<< orphan*/ geteuid();
int /*<<< orphan*/ print(unsigned char *, int);
int /*<<< orphan*/ printf(char *);
int /*<<< orphan*/ setresuid(int /*<<< orphan*/, int /*<<< orphan*/,
                             int /*<<< orphan*/);
int main() {
  unsigned char buf[512];
  unsigned char *ptr = buf + (sizeof(buf) / 2);
  unsigned int x;
  while ((x = getchar()) != EOF) {
    switch (x) {
    case '\n':
      print(buf, sizeof(buf));
      continue;
      break;
    case '\\':
      ptr--;
      break;
    default:;
      if (((unsigned int)ptr & 0xff000000) == 0xca000000) {
        setresuid(geteuid(), geteuid(), geteuid());
        execlp("/bin/sh", "sh", "-i", NULL);
      };
      if (ptr > buf + sizeof(buf))
        continue;
      ptr++;
      break;
    }
  }
  printf("All done\n");
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x230,%rsp
movl   $0x0,-0x4(%rbp)
lea    -0x210(%rbp),%rax
add    $0x100,%rax
mov    %rax,-0x218(%rbp)
mov    $0x0,%al
call   1070 <getchar@plt>
mov    %eax,-0x21c(%rbp)
mov    0x2e4e(%rip),%rcx
cmp    (%rcx),%eax
je     12a0 <main+0x140>
mov    -0x21c(%rbp),%eax
mov    %eax,-0x220(%rbp)
sub    $0xa,%eax
je     11d0 <main+0x70>
jmp    11bc <main+0x5c>
mov    -0x220(%rbp),%eax
sub    $0x5c,%eax
je     11e6 <main+0x86>
jmp    11fd <main+0x9d>
lea    -0x210(%rbp),%rdi
mov    $0x200,%esi
call   1060 <print@plt>
jmp    1186 <main+0x26>
mov    -0x218(%rbp),%rax
add    $0xffffffffffffffff,%rax
mov    %rax,-0x218(%rbp)
jmp    129b <main+0x13b>
mov    -0x218(%rbp),%rax
and    $0xff000000,%eax
cmp    $0xca000000,%eax
jne    1266 <main+0x106>
mov    $0x0,%al
call   1050 <geteuid@plt>
mov    %eax,-0x228(%rbp)
mov    $0x0,%al
call   1050 <geteuid@plt>
mov    %eax,-0x224(%rbp)
mov    $0x0,%al
call   1050 <geteuid@plt>
mov    -0x228(%rbp),%edi
mov    -0x224(%rbp),%esi
mov    %eax,%edx
call   1030 <setresuid@plt>
lea    0xdb1(%rip),%rdi
lea    0xdaf(%rip),%rsi
lea    0xdab(%rip),%rdx
xor    %eax,%eax
mov    %eax,%ecx
call   1080 <execlp@plt>
mov    -0x218(%rbp),%rax
lea    -0x210(%rbp),%rcx
add    $0x200,%rcx
cmp    %rcx,%rax
jbe    1289 <main+0x129>
jmp    1186 <main+0x26>
mov    -0x218(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x218(%rbp)
jmp    1186 <main+0x26>
lea    0xd64(%rip),%rdi
call   1040 <printf@plt>
mov    -0x4(%rbp),%eax
add    $0x230,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x218,%rsp
xor    %eax,%eax
call   1070 <getchar@plt>
mov    0x2e69(%rip),%r12
cmp    (%r12),%eax
jne    11a5 <main+0x45>
lea    0xe7f(%rip),%rdi
call   1030 <puts@plt>
xor    %eax,%eax
add    $0x218,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0x110(%rsp),%r15
lea    0x210(%rsp),%r13
lea    0x10(%rsp),%r14
mov    %r15d,%ebp
and    $0xff000000,%ebp
jmp    11ea <main+0x8a>
cs nopw 0x0(%rax,%rax,1)
nop
mov    %r14,%rdi
mov    $0x200,%esi
call   1060 <print@plt>
xor    %eax,%eax
call   1070 <getchar@plt>
cmp    (%r12),%eax
je     1185 <main+0x25>
cmp    $0xa,%eax
je     11d0 <main+0x70>
cmp    $0x5c,%eax
je     1250 <main+0xf0>
cmp    $0xca000000,%ebp
jne    1240 <main+0xe0>
xor    %eax,%eax
call   1050 <geteuid@plt>
mov    %eax,0xc(%rsp)
xor    %eax,%eax
call   1050 <geteuid@plt>
mov    %eax,%ebx
xor    %eax,%eax
call   1050 <geteuid@plt>
mov    0xc(%rsp),%edi
mov    %ebx,%esi
mov    %eax,%edx
call   1040 <setresuid@plt>
lea    0xdd5(%rip),%rdi
lea    0xdd3(%rip),%rsi
lea    0xdcf(%rip),%rdx
xor    %ecx,%ecx
call   1080 <execlp@plt>
cmp    %r13,%r15
ja     11dd <main+0x7d>
mov    $0x1,%eax
jmp    1257 <main+0xf7>
nopl   0x0(%rax)
mov    $0xffffffffffffffff,%rax
add    %rax,%r15
xor    %eax,%eax
call   1070 <getchar@plt>
cmp    (%r12),%eax
jne    11ba <main+0x5a>
jmp    1185 <main+0x25>

LLVM IR (-O0):
@EOF = global i32 0
@.str = [8 x i8] c"/bin/sh\00"
@.str.1 = [3 x i8] c"sh\00"
@.str.2 = [3 x i8] c"-i\00"
@.str.3 = [10 x i8] c"All done\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [512 x i8]
%3 = alloca i8*
%4 = alloca i32
store i32 0, i32* %1
%5 = getelementptr inbounds [512 x i8], [512 x i8]* %2, i64 0, i64 0
%6 = getelementptr inbounds i8, i8* %5, i64 256
store i8* %6, i8** %3
br label %7
7: ; preds = %39, %35, %13, %0
%8 = call i32 (...) @getchar()
store i32 %8, i32* %4
%9 = load i32, i32* @EOF
%10 = icmp ne i32 %8, %9
br i1 %10, label %11, label %40
11: ; preds = %7
%12 = load i32, i32* %4
switch i32 %12, label %19 [
i32 10, label %13
i32 92, label %16
]
13: ; preds = %11
%14 = getelementptr inbounds [512 x i8], [512 x i8]* %2, i64 0, i64 0
%15 = call i32 @print(i8* %14, i32 512)
br label %7
16: ; preds = %11
%17 = load i8*, i8** %3
%18 = getelementptr inbounds i8, i8* %17, i32 -1
store i8* %18, i8** %3
br label %39
19: ; preds = %11
%20 = load i8*, i8** %3
%21 = ptrtoint i8* %20 to i32
%22 = and i32 %21, -16777216
%23 = icmp eq i32 %22, -905969664
br i1 %23, label %24, label %30
24: ; preds = %19
%25 = call i32 (...) @geteuid()
%26 = call i32 (...) @geteuid()
%27 = call i32 (...) @geteuid()
%28 = call i32 @setresuid(i32 %25, i32 %26, i32 %27)
%29 = call i32 @execlp(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32* null)
br label %30
30: ; preds = %24, %19
%31 = load i8*, i8** %3
%32 = getelementptr inbounds [512 x i8], [512 x i8]* %2, i64 0, i64 0
%33 = getelementptr inbounds i8, i8* %32, i64 512
%34 = icmp ugt i8* %31, %33
br i1 %34, label %35, label %36
35: ; preds = %30
br label %7
36: ; preds = %30
%37 = load i8*, i8** %3
%38 = getelementptr inbounds i8, i8* %37, i32 1
store i8* %38, i8** %3
br label %39
39: ; preds = %36, %16
br label %7
40: ; preds = %7
%41 = call i32 @printf(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.3, i64 0, i64 0))
%42 = load i32, i32* %1
ret i32 %42
}

LLVM IR (-O2):
@EOF = global i32 0
@.str = [8 x i8] c"/bin/sh\00"
@.str.1 = [3 x i8] c"sh\00"
@.str.2 = [3 x i8] c"-i\00"
@str = [9 x i8] c"All done\00"
define i32 @main() {
%1 = alloca [512 x i8]
%2 = getelementptr inbounds [512 x i8], [512 x i8]* %1, i64 0, i64 0
%3 = call i32 (...) @getchar()
%4 = load i32, i32* @EOF
%5 = icmp eq i32 %3, %4
br i1 %5, label %38, label %6
6: ; preds = %0
%7 = getelementptr inbounds [512 x i8], [512 x i8]* %1, i64 0, i64 256
%8 = getelementptr inbounds [512 x i8], [512 x i8]* %1, i64 0, i64 512
br label %9
9: ; preds = %6, %32
%10 = phi i32 [ %3, %6 ], [ %35, %32 ]
%11 = phi i8* [ %7, %6 ], [ %34, %32 ]
%12 = ptrtoint i8* %11 to i64
%13 = and i64 %12, 4278190080
%14 = icmp eq i64 %13, 3388997632
%15 = icmp ugt i8* %11, %8
br label %16
16: ; preds = %9, %20
%17 = phi i32 [ %10, %9 ], [ %21, %20 ]
switch i32 %17, label %24 [
i32 10, label %18
i32 92, label %32
]
18: ; preds = %16
%19 = call i32 @print(i8* %2, i32 512)
br label %20
20: ; preds = %18, %31
%21 = call i32 (...) @getchar()
%22 = load i32, i32* @EOF
%23 = icmp eq i32 %21, %22
br i1 %23, label %38, label %16
24: ; preds = %16
br i1 %14, label %25, label %31
25: ; preds = %24
%26 = call i32 (...) @geteuid()
%27 = call i32 (...) @geteuid()
%28 = call i32 (...) @geteuid()
%29 = call i32 @setresuid(i32 %26, i32 %27, i32 %28)
%30 = call i32 @execlp(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32* null)
br label %31
31: ; preds = %25, %24
br i1 %15, label %20, label %32
32: ; preds = %31, %16
%33 = phi i64 [ -1, %16 ], [ 1, %31 ]
%34 = getelementptr inbounds i8, i8* %11, i64 %33
%35 = call i32 (...) @getchar()
%36 = load i32, i32* @EOF
%37 = icmp eq i32 %35, %36
br i1 %37, label %38, label %9
38: ; preds = %32, %20, %0
%39 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @str, i64 0, i64 0))
ret i32 0
}