#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ uid_t;
typedef int /*<<< orphan*/ gid_t;

/* Variables and functions */
scalar_t__ do_chroot(char *);
int do_pivot(char *);
int /*<<< orphan*/ execl(char *, char *, char *, int /*<<< orphan*/ *);
int /*<<< orphan*/ execvp(char *, char **);
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, char *);
int /*<<< orphan*/ getresgid(int /*<<< orphan*/ *, int /*<<< orphan*/ *,
                             int /*<<< orphan*/ *);
int /*<<< orphan*/ getresuid(int /*<<< orphan*/ *, int /*<<< orphan*/ *,
                             int /*<<< orphan*/ *);
scalar_t__ setresgid(int /*<<< orphan*/, int /*<<< orphan*/,
                     int /*<<< orphan*/);
scalar_t__ setresuid(int /*<<< orphan*/, int /*<<< orphan*/,
                     int /*<<< orphan*/);
int /*<<< orphan*/ stderr;
int main(int argc, char **argv) {
  uid_t ruid, euid, suid;
  gid_t rgid, egid, sgid;
  int rc;
  getresuid(&ruid, &euid, &suid);
  getresgid(&rgid, &egid, &sgid);
  if (0 && (rc = do_pivot(argv[1]))) {
    exit(2);
  }
  if (do_chroot(argv[1]))
    exit(2);
  if (setresuid(ruid, ruid, ruid)) {
    exit(2);
  }
  if (setresgid(rgid, rgid, rgid))
    exit(2);
  if (argc < 3) {
    execl("/bin/bash", "/bin/bash", "-sh", NULL);
    exit(2);
  }
  argv += 2;
  execvp(argv[0], argv);
  fprintf(stderr, "exec %s failed\n", argv[0]);
  exit(2);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    -0x14(%rbp),%rdi
lea    -0x18(%rbp),%rsi
lea    -0x1c(%rbp),%rdx
call   1080 <getresuid@plt>
lea    -0x20(%rbp),%rdi
lea    -0x24(%rbp),%rsi
lea    -0x28(%rbp),%rdx
call   1030 <getresgid@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1060 <do_chroot@plt>
cmp    $0x0,%rax
je     11e9 <main+0x59>
mov    $0x2,%edi
call   10a0 <exit@plt>
mov    -0x14(%rbp),%edi
mov    -0x14(%rbp),%esi
mov    -0x14(%rbp),%edx
call   1040 <setresuid@plt>
cmp    $0x0,%rax
je     120b <main+0x7b>
mov    $0x2,%edi
call   10a0 <exit@plt>
mov    -0x20(%rbp),%edi
mov    -0x20(%rbp),%esi
mov    -0x20(%rbp),%edx
call   1050 <setresgid@plt>
cmp    $0x0,%rax
je     122d <main+0x9d>
mov    $0x2,%edi
call   10a0 <exit@plt>
cmpl   $0x3,-0x8(%rbp)
jge    125b <main+0xcb>
lea    0xdc2(%rip),%rsi
lea    0xdc5(%rip),%rdx
xor    %eax,%eax
mov    %eax,%ecx
mov    %rsi,%rdi
call   10b0 <execl@plt>
mov    $0x2,%edi
call   10a0 <exit@plt>
mov    -0x10(%rbp),%rax
add    $0x10,%rax
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rdi
mov    -0x10(%rbp),%rsi
call   1090 <execvp@plt>
mov    0x2d62(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    (%rax),%rdx
lea    0xd80(%rip),%rsi
call   1070 <fprintf@plt>
mov    $0x2,%edi
call   10a0 <exit@plt>

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %rbx
sub    $0x18,%rsp
mov    %rsi,%rbx
mov    %edi,%ebp
lea    0x4(%rsp),%rdi
lea    0x14(%rsp),%rsi
lea    0x10(%rsp),%rdx
call   1080 <getresuid@plt>
mov    %rsp,%rdi
lea    0xc(%rsp),%rsi
lea    0x8(%rsp),%rdx
call   1030 <getresgid@plt>
mov    0x8(%rbx),%rdi
call   1060 <do_chroot@plt>
test   %rax,%rax
jne    123f <main+0xaf>
mov    0x4(%rsp),%edi
mov    %edi,%esi
mov    %edi,%edx
call   1040 <setresuid@plt>
test   %rax,%rax
jne    123f <main+0xaf>
mov    (%rsp),%edi
mov    %edi,%esi
mov    %edi,%edx
call   1050 <setresgid@plt>
test   %rax,%rax
jne    123f <main+0xaf>
cmp    $0x2,%ebp
jg     1219 <main+0x89>
lea    0xe02(%rip),%rdi
lea    0xe05(%rip),%rdx
mov    %rdi,%rsi
xor    %ecx,%ecx
call   10b0 <execl@plt>
mov    $0x2,%edi
call   10a0 <exit@plt>
lea    0x10(%rbx),%rsi
mov    0x10(%rbx),%rdi
call   1090 <execvp@plt>
mov    0x2db3(%rip),%rax
mov    (%rax),%edi
mov    0x10(%rbx),%rdx
lea    0xdd4(%rip),%rsi
call   1070 <fprintf@plt>
mov    $0x2,%edi
call   10a0 <exit@plt>

LLVM IR (-O0):
@.str = [10 x i8] c"/bin/bash\00"
@.str.1 = [4 x i8] c"-sh\00"
@stderr = global i32 0
@.str.2 = [16 x i8] c"exec %s failed\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i32
%12 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%13 = call i32 @getresuid(i32* %6, i32* %7, i32* %8)
%14 = call i32 @getresgid(i32* %9, i32* %10, i32* %11)
%15 = load i8**, i8*** %5
%16 = getelementptr inbounds i8*, i8** %15, i64 1
%17 = load i8*, i8** %16
%18 = call i64 @do_chroot(i8* %17)
%19 = icmp ne i64 %18, 0
br i1 %19, label %20, label %22
20: ; preds = %2
%21 = call i32 @exit(i32 2)
unreachable
22: ; preds = %2
%23 = load i32, i32* %6
%24 = load i32, i32* %6
%25 = load i32, i32* %6
%26 = call i64 @setresuid(i32 %23, i32 %24, i32 %25)
%27 = icmp ne i64 %26, 0
br i1 %27, label %28, label %30
28: ; preds = %22
%29 = call i32 @exit(i32 2)
unreachable
30: ; preds = %22
%31 = load i32, i32* %9
%32 = load i32, i32* %9
%33 = load i32, i32* %9
%34 = call i64 @setresgid(i32 %31, i32 %32, i32 %33)
%35 = icmp ne i64 %34, 0
br i1 %35, label %36, label %38
36: ; preds = %30
%37 = call i32 @exit(i32 2)
unreachable
38: ; preds = %30
%39 = load i32, i32* %4
%40 = icmp slt i32 %39, 3
br i1 %40, label %41, label %44
41: ; preds = %38
%42 = call i32 @execl(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i64 0, i64 0), i32* null)
%43 = call i32 @exit(i32 2)
unreachable
44: ; preds = %38
%45 = load i8**, i8*** %5
%46 = getelementptr inbounds i8*, i8** %45, i64 2
store i8** %46, i8*** %5
%47 = load i8**, i8*** %5
%48 = getelementptr inbounds i8*, i8** %47, i64 0
%49 = load i8*, i8** %48
%50 = load i8**, i8*** %5
%51 = call i32 @execvp(i8* %49, i8** %50)
%52 = load i32, i32* @stderr
%53 = load i8**, i8*** %5
%54 = getelementptr inbounds i8*, i8** %53, i64 0
%55 = load i8*, i8** %54
%56 = call i32 @fprintf(i32 %52, i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0), i8* %55)
%57 = call i32 @exit(i32 2)
unreachable
}

LLVM IR (-O2):
@.str = [10 x i8] c"/bin/bash\00"
@.str.1 = [4 x i8] c"-sh\00"
@stderr = global i32 0
@.str.2 = [16 x i8] c"exec %s failed\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i32
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = bitcast i32* %3 to i8*
%10 = bitcast i32* %4 to i8*
%11 = bitcast i32* %5 to i8*
%12 = bitcast i32* %6 to i8*
%13 = bitcast i32* %7 to i8*
%14 = bitcast i32* %8 to i8*
%15 = call i32 @getresuid(i32* %3, i32* %4, i32* %5)
%16 = call i32 @getresgid(i32* %6, i32* %7, i32* %8)
%17 = getelementptr inbounds i8*, i8** %1, i64 1
%18 = load i8*, i8** %17
%19 = call i64 @do_chroot(i8* %18)
%20 = icmp eq i64 %19, 0
br i1 %20, label %23, label %21
21: ; preds = %2
%22 = call i32 @exit(i32 2)
unreachable
23: ; preds = %2
%24 = load i32, i32* %3
%25 = call i64 @setresuid(i32 %24, i32 %24, i32 %24)
%26 = icmp eq i64 %25, 0
br i1 %26, label %29, label %27
27: ; preds = %23
%28 = call i32 @exit(i32 2)
unreachable
29: ; preds = %23
%30 = load i32, i32* %6
%31 = call i64 @setresgid(i32 %30, i32 %30, i32 %30)
%32 = icmp eq i64 %31, 0
br i1 %32, label %35, label %33
33: ; preds = %29
%34 = call i32 @exit(i32 2)
unreachable
35: ; preds = %29
%36 = icmp slt i32 %0, 3
br i1 %36, label %37, label %40
37: ; preds = %35
%38 = call i32 @execl(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.1, i64 0, i64 0), i32* null)
%39 = call i32 @exit(i32 2)
unreachable
40: ; preds = %35
%41 = getelementptr inbounds i8*, i8** %1, i64 2
%42 = load i8*, i8** %41
%43 = call i32 @execvp(i8* %42, i8** %41)
%44 = load i32, i32* @stderr
%45 = load i8*, i8** %41
%46 = call i32 @fprintf(i32 %44, i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0), i8* %45)
%47 = call i32 @exit(i32 2)
unreachable
}