#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ fork_shell();
int /*<<< orphan*/ is_root();
int /*<<< orphan*/ printf(char *);
void check_root() {
  printf("[.] checking if we got root\n");
  if (!is_root()) {
    printf("[-] something went wrong =(\n");
    printf("[!] don't kill the exploit binary, the kernel will crash\n");
    return;
  }
  printf("[+] got r00t ^_^\n");
  printf("[!] don't kill the exploit binary, the kernel will crash\n");
  fork_shell();
}


x86 assembly (clang, -O0):
<check_root>:
push   %rbp
mov    %rsp,%rbp
lea    0xec5(%rip),%rdi
call   1040 <printf@plt>
mov    $0x0,%al
call   1050 <is_root@plt>
cmp    $0x0,%eax
jne    116d <check_root+0x3d>
lea    0xec6(%rip),%rdi
call   1040 <printf@plt>
lea    0xed7(%rip),%rdi
call   1040 <printf@plt>
jmp    118c <check_root+0x5c>
lea    0xf00(%rip),%rdi
call   1040 <printf@plt>
lea    0xeba(%rip),%rdi
call   1040 <printf@plt>
mov    $0x0,%al
call   1030 <fork_shell@plt>
pop    %rbp
ret

x86 assembly (clang, -O2):
<check_root>:
push   %rax
lea    0xec8(%rip),%rdi
call   1030 <puts@plt>
xor    %eax,%eax
call   1050 <is_root@plt>
test   %eax,%eax
je     1168 <check_root+0x38>
lea    0xee9(%rip),%rdi
call   1030 <puts@plt>
lea    0xeee(%rip),%rdi
call   1030 <puts@plt>
xor    %eax,%eax
pop    %rcx
jmp    1040 <fork_shell@plt>
lea    0xead(%rip),%rdi
call   1030 <puts@plt>
lea    0xece(%rip),%rdi
pop    %rax
jmp    1030 <puts@plt>

LLVM IR (-O0):
@.str = [29 x i8] c"[.] checking if we got root\0A\00"
@.str.1 = [29 x i8] c"[-] something went wrong =(\0A\00"
@.str.2 = [58 x i8] c"[!] don't kill the exploit binary, the kernel will crash\0A\00"
@.str.3 = [18 x i8] c"[+] got r00t ^_^\0A\00"
define void @check_root() {
%1 = call i32 @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str, i64 0, i64 0))
%2 = call i32 (...) @is_root()
%3 = icmp ne i32 %2, 0
br i1 %3, label %7, label %4
4: ; preds = %0
%5 = call i32 @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.1, i64 0, i64 0))
%6 = call i32 @printf(i8* getelementptr inbounds ([58 x i8], [58 x i8]* @.str.2, i64 0, i64 0))
br label %11
7: ; preds = %0
%8 = call i32 @printf(i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.3, i64 0, i64 0))
%9 = call i32 @printf(i8* getelementptr inbounds ([58 x i8], [58 x i8]* @.str.2, i64 0, i64 0))
%10 = call i32 (...) @fork_shell()
br label %11
11: ; preds = %7, %4
ret void
}

LLVM IR (-O2):
@str = [28 x i8] c"[.] checking if we got root\00"
@str.4 = [28 x i8] c"[-] something went wrong =(\00"
@str.6 = [17 x i8] c"[+] got r00t ^_^\00"
@str.7 = [57 x i8] c"[!] don't kill the exploit binary, the kernel will crash\00"
define void @check_root() {
%1 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([28 x i8], [28 x i8]* @str, i64 0, i64 0))
%2 = tail call i32 (...) @is_root()
%3 = icmp eq i32 %2, 0
br i1 %3, label %4, label %7
4: ; preds = %0
%5 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([28 x i8], [28 x i8]* @str.4, i64 0, i64 0))
%6 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([57 x i8], [57 x i8]* @str.7, i64 0, i64 0))
br label %11
7: ; preds = %0
%8 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([17 x i8], [17 x i8]* @str.6, i64 0, i64 0))
%9 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([57 x i8], [57 x i8]* @str.7, i64 0, i64 0))
%10 = tail call i32 (...) @fork_shell()
br label %11
11: ; preds = %7, %4
ret void
}