#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef unsigned int (*function)();

/* Variables and functions */
int MAP_ANONYMOUS;
int MAP_PRIVATE;
int PROT_READ;
int PROT_WRITE;
scalar_t__ mmap(int /*<<< orphan*/ *, scalar_t__, int, int, int /*<<< orphan*/,
                int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *, void *);
int /*<<< orphan*/ puts(char *);
int /*<<< orphan*/ strcat(unsigned char *, char *);
int /*<<< orphan*/ strcpy(unsigned char *, char *);
scalar_t__ strlen(char *);
int main(int argc, char *argv[]) {
  if (argc < 2) {
    puts("Runs shellcode as a command line arguments.");
    puts("Use: testshellcode [shellcode]");
  }
  puts("Shellcode is:");
  puts(argv[1]);
  void *shellcode =
      (char *)mmap(NULL, strlen(argv[1]) + 1, PROT_READ | PROT_WRITE,
                   MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
  unsigned char *temp = (unsigned char *)(shellcode);
  printf("Shellcode address: %p\n", shellcode);
  strcpy(temp, argv[1]);
  strcat(temp, "\xc3");
  typedef unsigned (*function)(void);
  function func = (function)shellcode;
  unsigned out = func();
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
cmpl   $0x2,-0x8(%rbp)
jge    1198 <main+0x38>
lea    0xe79(%rip),%rdi
call   1040 <puts@plt>
lea    0xe99(%rip),%rdi
call   1040 <puts@plt>
lea    0xeac(%rip),%rdi
call   1040 <puts@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1040 <puts@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1050 <strlen@plt>
mov    %rax,%rsi
add    $0x1,%rsi
mov    0x2e2c(%rip),%rax
mov    (%rax),%edx
mov    0x2dfb(%rip),%rax
or     (%rax),%edx
mov    0x2dea(%rip),%rax
mov    (%rax),%ecx
mov    0x2df9(%rip),%rax
or     (%rax),%ecx
xor    %eax,%eax
mov    %eax,%edi
xor    %r9d,%r9d
mov    %r9d,%r8d
call   1060 <mmap@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x18(%rbp),%rsi
lea    0xe4a(%rip),%rdi
call   1070 <printf@plt>
mov    -0x20(%rbp),%rdi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rsi
call   1030 <strcpy@plt>
mov    -0x20(%rbp),%rdi
lea    0xe40(%rip),%rsi
call   1080 <strcat@plt>
mov    -0x18(%rbp),%rax
mov    %rax,-0x28(%rbp)
call   *-0x28(%rbp)
mov    %eax,-0x2c(%rbp)
mov    -0x4(%rbp),%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
push   %rax
mov    %rsi,%r14
cmp    $0x1,%edi
jg     1184 <main+0x24>
lea    0xe8d(%rip),%rdi
call   1040 <puts@plt>
lea    0xead(%rip),%rdi
call   1040 <puts@plt>
lea    0xec0(%rip),%rdi
call   1040 <puts@plt>
mov    0x8(%r14),%rdi
call   1040 <puts@plt>
mov    0x8(%r14),%rdi
call   1050 <strlen@plt>
lea    0x1(%rax),%rsi
mov    0x2e4b(%rip),%rax
mov    0x2e1c(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
mov    0x2e09(%rip),%rax
mov    0x2e1a(%rip),%rcx
mov    (%rcx),%ecx
or     (%rax),%ecx
xor    %edi,%edi
xor    %r8d,%r8d
xor    %r9d,%r9d
call   1060 <mmap@plt>
mov    %rax,%rbx
lea    0xe78(%rip),%rdi
mov    %rax,%rsi
call   1070 <printf@plt>
mov    0x8(%r14),%rsi
mov    %rbx,%rdi
call   1030 <strcpy@plt>
lea    0xe74(%rip),%rsi
mov    %rbx,%rdi
call   1080 <strcat@plt>
call   *%rbx
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@.str = [44 x i8] c"Runs shellcode as a command line arguments.\00"
@.str.1 = [31 x i8] c"Use: testshellcode [shellcode]\00"
@.str.2 = [14 x i8] c"Shellcode is:\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@.str.3 = [23 x i8] c"Shellcode address: %p\0A\00"
@.str.4 = [2 x i8] c"\C3\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i32 ()*
%9 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%10 = load i32, i32* %4
%11 = icmp slt i32 %10, 2
br i1 %11, label %12, label %15
12: ; preds = %2
%13 = call i32 @puts(i8* getelementptr inbounds ([44 x i8], [44 x i8]* @.str, i64 0, i64 0))
%14 = call i32 @puts(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.1, i64 0, i64 0))
br label %15
15: ; preds = %12, %2
%16 = call i32 @puts(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0))
%17 = load i8**, i8*** %5
%18 = getelementptr inbounds i8*, i8** %17, i64 1
%19 = load i8*, i8** %18
%20 = call i32 @puts(i8* %19)
%21 = load i8**, i8*** %5
%22 = getelementptr inbounds i8*, i8** %21, i64 1
%23 = load i8*, i8** %22
%24 = call i64 @strlen(i8* %23)
%25 = add nsw i64 %24, 1
%26 = load i32, i32* @PROT_READ
%27 = load i32, i32* @PROT_WRITE
%28 = or i32 %26, %27
%29 = load i32, i32* @MAP_PRIVATE
%30 = load i32, i32* @MAP_ANONYMOUS
%31 = or i32 %29, %30
%32 = call i64 @mmap(i32* null, i64 %25, i32 %28, i32 %31, i32 0, i32 0)
%33 = inttoptr i64 %32 to i8*
store i8* %33, i8** %6
%34 = load i8*, i8** %6
store i8* %34, i8** %7
%35 = load i8*, i8** %6
%36 = call i32 @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.3, i64 0, i64 0), i8* %35)
%37 = load i8*, i8** %7
%38 = load i8**, i8*** %5
%39 = getelementptr inbounds i8*, i8** %38, i64 1
%40 = load i8*, i8** %39
%41 = call i32 @strcpy(i8* %37, i8* %40)
%42 = load i8*, i8** %7
%43 = call i32 @strcat(i8* %42, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.4, i64 0, i64 0))
%44 = load i8*, i8** %6
%45 = bitcast i8* %44 to i32 ()*
store i32 ()* %45, i32 ()** %8
%46 = load i32 ()*, i32 ()** %8
%47 = call i32 %46()
store i32 %47, i32* %9
%48 = load i32, i32* %3
ret i32 %48
}

LLVM IR (-O2):
@.str = [44 x i8] c"Runs shellcode as a command line arguments.\00"
@.str.1 = [31 x i8] c"Use: testshellcode [shellcode]\00"
@.str.2 = [14 x i8] c"Shellcode is:\00"
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@.str.3 = [23 x i8] c"Shellcode address: %p\0A\00"
@.str.4 = [2 x i8] c"\C3\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = icmp slt i32 %0, 2
br i1 %3, label %4, label %7
4: ; preds = %2
%5 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([44 x i8], [44 x i8]* @.str, i64 0, i64 0))
%6 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([31 x i8], [31 x i8]* @.str.1, i64 0, i64 0))
br label %7
7: ; preds = %4, %2
%8 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0))
%9 = getelementptr inbounds i8*, i8** %1, i64 1
%10 = load i8*, i8** %9
%11 = tail call i32 @puts(i8* dereferenceable(1) %10)
%12 = load i8*, i8** %9
%13 = tail call i64 @strlen(i8* dereferenceable(1) %12)
%14 = add nsw i64 %13, 1
%15 = load i32, i32* @PROT_READ
%16 = load i32, i32* @PROT_WRITE
%17 = or i32 %16, %15
%18 = load i32, i32* @MAP_PRIVATE
%19 = load i32, i32* @MAP_ANONYMOUS
%20 = or i32 %19, %18
%21 = tail call i64 @mmap(i32* null, i64 %14, i32 %17, i32 %20, i32 0, i32 0)
%22 = inttoptr i64 %21 to i8*
%23 = tail call i32 @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.3, i64 0, i64 0), i8* %22)
%24 = load i8*, i8** %9
%25 = tail call i32 @strcpy(i8* %22, i8* %24)
%26 = tail call i32 @strcat(i8* %22, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.4, i64 0, i64 0))
%27 = inttoptr i64 %21 to i32 ()*
%28 = tail call i32 %27()
ret i32 0
}