#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ scanf(char *, char **);
int /*<<< orphan*/ system(char *);
int main() {
  char val = 'A';
  char buf[20];
  printf("Correct val's value from 'A' -> 'W'!\n");
  printf("Here is your chance: ");
  scanf("%21s", &buf);
  printf("buf: %s\n", buf);
  printf("val: %c\n", val);
  if (val == 'W')
    system("/bin/sh");
  else {
    printf("WAY OFF!!!!\n");
    exit(1);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
movb   $0x41,-0x5(%rbp)
lea    0xea6(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    0xebe(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    -0x20(%rbp),%rsi
lea    0xec2(%rip),%rdi
call   1050 <scanf@plt>
lea    -0x20(%rbp),%rsi
lea    0xeb7(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movsbl -0x5(%rbp),%esi
lea    0xeae(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movsbl -0x5(%rbp),%eax
cmp    $0x57,%eax
jne    11c1 <main+0x81>
lea    0xe9c(%rip),%rdi
call   1030 <system@plt>
jmp    11d9 <main+0x99>
lea    0xe93(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    $0x1,%edi
call   1060 <exit@plt>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
sub    $0x20,%rsp
lea    0xee1(%rip),%rdi
call   1030 <puts@plt>
lea    0xea8(%rip),%rdi
xor    %eax,%eax
call   1040 <printf@plt>
lea    0xeb0(%rip),%rdi
mov    %rsp,%rbx
mov    %rbx,%rsi
call   1050 <scanf@plt>
lea    0xea3(%rip),%rdi
mov    %rbx,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
lea    0xe9b(%rip),%rdi
mov    $0x41,%esi
xor    %eax,%eax
call   1040 <printf@plt>
lea    0xeb6(%rip),%rdi
call   1030 <puts@plt>
mov    $0x1,%edi
call   1060 <exit@plt>

LLVM IR (-O0):
@.str = [38 x i8] c"Correct val's value from 'A' -> 'W'!\0A\00"
@.str.1 = [22 x i8] c"Here is your chance: \00"
@.str.2 = [5 x i8] c"%21s\00"
@.str.3 = [9 x i8] c"buf: %s\0A\00"
@.str.4 = [9 x i8] c"val: %c\0A\00"
@.str.5 = [8 x i8] c"/bin/sh\00"
@.str.6 = [13 x i8] c"WAY OFF!!!!\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i8
%3 = alloca [20 x i8]
store i32 0, i32* %1
store i8 65, i8* %2
%4 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str, i64 0, i64 0))
%5 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.1, i64 0, i64 0))
%6 = bitcast [20 x i8]* %3 to i8**
%7 = call i32 @scanf(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0), i8** %6)
%8 = getelementptr inbounds [20 x i8], [20 x i8]* %3, i64 0, i64 0
%9 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i8* %8)
%10 = load i8, i8* %2
%11 = sext i8 %10 to i32
%12 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.4, i64 0, i64 0), i32 %11)
%13 = load i8, i8* %2
%14 = sext i8 %13 to i32
%15 = icmp eq i32 %14, 87
br i1 %15, label %16, label %18
16: ; preds = %0
%17 = call i32 @system(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.5, i64 0, i64 0))
br label %21
18: ; preds = %0
%19 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.6, i64 0, i64 0))
%20 = call i32 @exit(i32 1)
unreachable
21: ; preds = %16
ret i32 0
}

LLVM IR (-O2):
@.str.1 = [22 x i8] c"Here is your chance: \00"
@.str.2 = [5 x i8] c"%21s\00"
@.str.3 = [9 x i8] c"buf: %s\0A\00"
@.str.4 = [9 x i8] c"val: %c\0A\00"
@str = [37 x i8] c"Correct val's value from 'A' -> 'W'!\00"
@str.7 = [12 x i8] c"WAY OFF!!!!\00"
define i32 @main() {
%1 = alloca [20 x i8]
%2 = getelementptr inbounds [20 x i8], [20 x i8]* %1, i64 0, i64 0
%3 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([37 x i8], [37 x i8]* @str, i64 0, i64 0))
%4 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @.str.1, i64 0, i64 0))
%5 = bitcast [20 x i8]* %1 to i8**
%6 = call i32 @scanf(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0), i8** %5)
%7 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i8* %2)
%8 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str.4, i64 0, i64 0), i32 65)
%9 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([12 x i8], [12 x i8]* @str.7, i64 0, i64 0))
%10 = call i32 @exit(i32 1)
unreachable
}