#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct in_addr {
  int dummy;
};
struct sockaddr_in {
  struct in_addr sin_addr;
  int /*<<< orphan*/ sin_port;
  int /*<<< orphan*/ sin_family;
};
struct hostent {
  scalar_t__ *h_addr_list;
};
typedef int /*<<< orphan*/ on;

/* Variables and functions */
int /*<<< orphan*/ AF_INET;
int /*<<< orphan*/ IPPROTO_IP;
int /*<<< orphan*/ IPPROTO_TCP;
int /*<<< orphan*/ IP_HDRINCL;
int /*<<< orphan*/ SOCK_RAW;
unsigned short atoi(char *);
int /*<<< orphan*/ attack(int, struct sockaddr_in *, unsigned short);
int /*<<< orphan*/ bzero(struct sockaddr_in *, int);
int /*<<< orphan*/ exit(int);
struct hostent *gethostbyname(char *);
int /*<<< orphan*/ getpid();
int /*<<< orphan*/ h_errno;
char *hstrerror(int /*<<< orphan*/);
int /*<<< orphan*/ htons(unsigned short);
scalar_t__ inet_aton(char *, struct in_addr *);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, ...);
scalar_t__ setsockopt(int, int /*<<< orphan*/, int /*<<< orphan*/, int const *,
                      int);
int /*<<< orphan*/ setuid(int /*<<< orphan*/);
int socket(int /*<<< orphan*/, int /*<<< orphan*/, int /*<<< orphan*/);
int main(int argc, char **argv) {
  printf("tcp attack start...\n");
  int skfd;
  struct sockaddr_in target;
  struct hostent *host;
  const int on = 1;
  unsigned short srcport;
  if (argc != 4) {
    printf("Usage: %s target dstpost srcport\n", argv[0]);
    exit(1);
  }
  bzero(&target, sizeof(struct sockaddr_in));
  target.sin_family = AF_INET;
  target.sin_port = htons(atoi(argv[2]));
  if (inet_aton(argv[1], &target.sin_addr) == 0) {
    host = gethostbyname(argv[1]);
    if (host == NULL) {
      printf("TargetName Error:%s\n", hstrerror(h_errno));
      exit(1);
    }
    target.sin_addr = *(struct in_addr *)(host->h_addr_list[0]);
  }
  skfd = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
  if (skfd < 0) {
    perror("Create socket Error\n");
    exit(1);
  }
  if (setsockopt(skfd, IPPROTO_IP, IP_HDRINCL, &on, sizeof(on))) {
    perror("IP_HDRINCL OPEN Failed\n");
    exit(1);
  }
  setuid(getpid());
  srcport = atoi(argv[3]);
  attack(skfd, &target, srcport);
  exit(1);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    0xe03(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movl   $0x1,-0x2c(%rbp)
cmpl   $0x4,-0x8(%rbp)
je     1234 <main+0x54>
mov    -0x10(%rbp),%rax
mov    (%rax),%rsi
lea    0xdf2(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    $0x1,%edi
call   10e0 <exit@plt>
lea    -0x20(%rbp),%rdi
mov    $0xc,%esi
call   10b0 <bzero@plt>
mov    0x2d97(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
call   10d0 <atoi@plt>
movzwl %ax,%edi
call   1050 <htons@plt>
mov    %eax,-0x1c(%rbp)
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
lea    -0x20(%rbp),%rsi
call   1080 <inet_aton@plt>
cmp    $0x0,%rax
jne    12d5 <main+0xf5>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1070 <gethostbyname@plt>
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x28(%rbp)
jne    12c6 <main+0xe6>
mov    0x2d1c(%rip),%rax
mov    (%rax),%edi
call   10c0 <hstrerror@plt>
mov    %rax,%rsi
lea    0xd82(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    $0x1,%edi
call   10e0 <exit@plt>
mov    -0x28(%rbp),%rax
mov    (%rax),%rax
mov    (%rax),%rax
mov    (%rax),%eax
mov    %eax,-0x20(%rbp)
mov    0x2d04(%rip),%rax
mov    (%rax),%edi
mov    0x2cf3(%rip),%rax
mov    (%rax),%esi
mov    0x2cda(%rip),%rax
mov    (%rax),%edx
call   1100 <socket@plt>
mov    %eax,-0x14(%rbp)
cmpl   $0x0,-0x14(%rbp)
jge    1318 <main+0x138>
lea    0xd43(%rip),%rdi
call   10a0 <perror@plt>
mov    $0x1,%edi
call   10e0 <exit@plt>
mov    -0x14(%rbp),%edi
mov    0x2cae(%rip),%rax
mov    (%rax),%esi
mov    0x2cc5(%rip),%rax
mov    (%rax),%edx
lea    -0x2c(%rbp),%rcx
mov    $0x4,%r8d
call   1030 <setsockopt@plt>
cmp    $0x0,%rax
je     135c <main+0x17c>
lea    0xd14(%rip),%rdi
call   10a0 <perror@plt>
mov    $0x1,%edi
call   10e0 <exit@plt>
mov    $0x0,%al
call   1040 <getpid@plt>
mov    %eax,%edi
call   10f0 <setuid@plt>
mov    -0x10(%rbp),%rax
mov    0x18(%rax),%rdi
call   10d0 <atoi@plt>
mov    %ax,-0x2e(%rbp)
mov    -0x14(%rbp),%edi
lea    -0x20(%rbp),%rsi
movzwl -0x2e(%rbp),%edx
call   1090 <attack@plt>
mov    $0x1,%edi
call   10e0 <exit@plt>

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r14
push   %rbx
sub    $0x20,%rsp
mov    %rsi,%rbx
mov    %edi,%ebp
lea    0xe60(%rip),%rdi
call   1030 <puts@plt>
movl   $0x1,0xc(%rsp)
cmp    $0x4,%ebp
jne    1284 <main+0x94>
lea    0x10(%rsp),%rbp
mov    %rbp,%rdi
mov    $0xc,%esi
call   10c0 <bzero@plt>
mov    0x2db1(%rip),%r14
mov    (%r14),%eax
mov    %eax,0x18(%rsp)
mov    0x10(%rbx),%rdi
call   10e0 <atoi@plt>
movzwl %ax,%edi
call   1060 <htons@plt>
mov    %eax,0x14(%rsp)
mov    0x8(%rbx),%rdi
mov    %rbp,%rsi
call   1090 <inet_aton@plt>
test   %rax,%rax
jne    12ab <main+0xbb>
mov    0x8(%rbx),%rdi
call   1080 <gethostbyname@plt>
test   %rax,%rax
jne    129f <main+0xaf>
mov    0x2d4f(%rip),%rax
mov    (%rax),%edi
call   10d0 <hstrerror@plt>
lea    0xda3(%rip),%rdi
mov    %rax,%rsi
jmp    128e <main+0x9e>
mov    (%rbx),%rsi
lea    0xd72(%rip),%rdi
xor    %eax,%eax
call   1070 <printf@plt>
mov    $0x1,%edi
call   10f0 <exit@plt>
mov    (%rax),%rax
mov    (%rax),%rax
mov    (%rax),%eax
mov    %eax,0x10(%rsp)
mov    (%r14),%edi
mov    0x2d23(%rip),%rax
mov    (%rax),%esi
mov    0x2d0a(%rip),%rax
mov    (%rax),%edx
call   1110 <socket@plt>
test   %eax,%eax
jns    12d2 <main+0xe2>
lea    0xd67(%rip),%rdi
jmp    1334 <main+0x144>
mov    %eax,%ebp
mov    0x2cf5(%rip),%rax
mov    (%rax),%esi
mov    0x2d0c(%rip),%rax
mov    (%rax),%edx
lea    0xc(%rsp),%rcx
mov    %ebp,%edi
mov    $0x4,%r8d
call   1040 <setsockopt@plt>
test   %rax,%rax
jne    132d <main+0x13d>
xor    %eax,%eax
call   1050 <getpid@plt>
mov    %eax,%edi
call   1100 <setuid@plt>
mov    0x18(%rbx),%rdi
call   10e0 <atoi@plt>
movzwl %ax,%edx
lea    0x10(%rsp),%rsi
mov    %ebp,%edi
call   10a0 <attack@plt>
mov    $0x1,%edi
call   10f0 <exit@plt>
lea    0xd18(%rip),%rdi
call   10b0 <perror@plt>
mov    $0x1,%edi
call   10f0 <exit@plt>

LLVM IR (-O0):
%struct.sockaddr_in = type { %struct.in_addr, i32, i32 }
%struct.in_addr = type { i32 }
%struct.hostent = type { i64* }
@.str = [21 x i8] c"tcp attack start...\0A\00"
@.str.1 = [34 x i8] c"Usage: %s target dstpost srcport\0A\00"
@AF_INET = global i32 0
@.str.2 = [21 x i8] c"TargetName Error:%s\0A\00"
@h_errno = global i32 0
@SOCK_RAW = global i32 0
@IPPROTO_TCP = global i32 0
@.str.3 = [21 x i8] c"Create socket Error\0A\00"
@IPPROTO_IP = global i32 0
@IP_HDRINCL = global i32 0
@.str.4 = [24 x i8] c"IP_HDRINCL OPEN Failed\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca %struct.sockaddr_in
%8 = alloca %struct.hostent*
%9 = alloca i32
%10 = alloca i16
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%11 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str, i64 0, i64 0))
store i32 1, i32* %9
%12 = load i32, i32* %4
%13 = icmp ne i32 %12, 4
br i1 %13, label %14, label %20
14: ; preds = %2
%15 = load i8**, i8*** %5
%16 = getelementptr inbounds i8*, i8** %15, i64 0
%17 = load i8*, i8** %16
%18 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %17)
%19 = call i32 @exit(i32 1)
unreachable
20: ; preds = %2
%21 = call i32 @bzero(%struct.sockaddr_in* %7, i32 12)
%22 = load i32, i32* @AF_INET
%23 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %7, i32 0, i32 2
store i32 %22, i32* %23
%24 = load i8**, i8*** %5
%25 = getelementptr inbounds i8*, i8** %24, i64 2
%26 = load i8*, i8** %25
%27 = call zeroext i16 @atoi(i8* %26)
%28 = call i32 @htons(i16 zeroext %27)
%29 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %7, i32 0, i32 1
store i32 %28, i32* %29
%30 = load i8**, i8*** %5
%31 = getelementptr inbounds i8*, i8** %30, i64 1
%32 = load i8*, i8** %31
%33 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %7, i32 0, i32 0
%34 = call i64 @inet_aton(i8* %32, %struct.in_addr* %33)
%35 = icmp eq i64 %34, 0
br i1 %35, label %36, label %58
36: ; preds = %20
%37 = load i8**, i8*** %5
%38 = getelementptr inbounds i8*, i8** %37, i64 1
%39 = load i8*, i8** %38
%40 = call %struct.hostent* @gethostbyname(i8* %39)
store %struct.hostent* %40, %struct.hostent** %8
%41 = load %struct.hostent*, %struct.hostent** %8
%42 = icmp eq %struct.hostent* %41, null
br i1 %42, label %43, label %48
43: ; preds = %36
%44 = load i32, i32* @h_errno
%45 = call i8* @hstrerror(i32 %44)
%46 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.2, i64 0, i64 0), i8* %45)
%47 = call i32 @exit(i32 1)
unreachable
48: ; preds = %36
%49 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %7, i32 0, i32 0
%50 = load %struct.hostent*, %struct.hostent** %8
%51 = getelementptr inbounds %struct.hostent, %struct.hostent* %50, i32 0, i32 0
%52 = load i64*, i64** %51
%53 = getelementptr inbounds i64, i64* %52, i64 0
%54 = load i64, i64* %53
%55 = inttoptr i64 %54 to %struct.in_addr*
%56 = bitcast %struct.in_addr* %49 to i8*
%57 = bitcast %struct.in_addr* %55 to i8*
br label %58
58: ; preds = %48, %20
%59 = load i32, i32* @AF_INET
%60 = load i32, i32* @SOCK_RAW
%61 = load i32, i32* @IPPROTO_TCP
%62 = call i32 @socket(i32 %59, i32 %60, i32 %61)
store i32 %62, i32* %6
%63 = load i32, i32* %6
%64 = icmp slt i32 %63, 0
br i1 %64, label %65, label %68
65: ; preds = %58
%66 = call i32 @perror(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.3, i64 0, i64 0))
%67 = call i32 @exit(i32 1)
unreachable
68: ; preds = %58
%69 = load i32, i32* %6
%70 = load i32, i32* @IPPROTO_IP
%71 = load i32, i32* @IP_HDRINCL
%72 = call i64 @setsockopt(i32 %69, i32 %70, i32 %71, i32* %9, i32 4)
%73 = icmp ne i64 %72, 0
br i1 %73, label %74, label %77
74: ; preds = %68
%75 = call i32 @perror(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.4, i64 0, i64 0))
%76 = call i32 @exit(i32 1)
unreachable
77: ; preds = %68
%78 = call i32 (...) @getpid()
%79 = call i32 @setuid(i32 %78)
%80 = load i8**, i8*** %5
%81 = getelementptr inbounds i8*, i8** %80, i64 3
%82 = load i8*, i8** %81
%83 = call zeroext i16 @atoi(i8* %82)
store i16 %83, i16* %10
%84 = load i32, i32* %6
%85 = load i16, i16* %10
%86 = call i32 @attack(i32 %84, %struct.sockaddr_in* %7, i16 zeroext %85)
%87 = call i32 @exit(i32 1)
unreachable
}

LLVM IR (-O2):
%struct.sockaddr_in = type { %struct.in_addr, i32, i32 }
%struct.in_addr = type { i32 }
%struct.hostent = type { i64* }
@.str.1 = [34 x i8] c"Usage: %s target dstpost srcport\0A\00"
@AF_INET = global i32 0
@.str.2 = [21 x i8] c"TargetName Error:%s\0A\00"
@h_errno = global i32 0
@SOCK_RAW = global i32 0
@IPPROTO_TCP = global i32 0
@.str.3 = [21 x i8] c"Create socket Error\0A\00"
@IPPROTO_IP = global i32 0
@IP_HDRINCL = global i32 0
@.str.4 = [24 x i8] c"IP_HDRINCL OPEN Failed\0A\00"
@str = [20 x i8] c"tcp attack start...\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca %struct.sockaddr_in
%4 = alloca i32
%5 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([20 x i8], [20 x i8]* @str, i64 0, i64 0))
%6 = bitcast %struct.sockaddr_in* %3 to i8*
%7 = bitcast i32* %4 to i8*
store i32 1, i32* %4
%8 = icmp eq i32 %0, 4
br i1 %8, label %13, label %9
9: ; preds = %2
%10 = load i8*, i8** %1
%11 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([34 x i8], [34 x i8]* @.str.1, i64 0, i64 0), i8* %10)
%12 = tail call i32 @exit(i32 1)
unreachable
13: ; preds = %2
%14 = call i32 @bzero(%struct.sockaddr_in* %3, i32 12)
%15 = load i32, i32* @AF_INET
%16 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 2
store i32 %15, i32* %16
%17 = getelementptr inbounds i8*, i8** %1, i64 2
%18 = load i8*, i8** %17
%19 = tail call zeroext i16 @atoi(i8* %18)
%20 = tail call i32 @htons(i16 zeroext %19)
%21 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 1
store i32 %20, i32* %21
%22 = getelementptr inbounds i8*, i8** %1, i64 1
%23 = load i8*, i8** %22
%24 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 0
%25 = call i64 @inet_aton(i8* %23, %struct.in_addr* %24)
%26 = icmp eq i64 %25, 0
br i1 %26, label %27, label %43
27: ; preds = %13
%28 = load i8*, i8** %22
%29 = call %struct.hostent* @gethostbyname(i8* %28)
%30 = icmp eq %struct.hostent* %29, null
br i1 %30, label %31, label %36
31: ; preds = %27
%32 = load i32, i32* @h_errno
%33 = call i8* @hstrerror(i32 %32)
%34 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([21 x i8], [21 x i8]* @.str.2, i64 0, i64 0), i8* %33)
%35 = call i32 @exit(i32 1)
unreachable
36: ; preds = %27
%37 = getelementptr inbounds %struct.hostent, %struct.hostent* %29, i64 0, i32 0
%38 = load i64*, i64** %37
%39 = load i64, i64* %38
%40 = inttoptr i64 %39 to i32*
%41 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 0, i32 0
%42 = load i32, i32* %40
store i32 %42, i32* %41
br label %43
43: ; preds = %36, %13
%44 = load i32, i32* @AF_INET
%45 = load i32, i32* @SOCK_RAW
%46 = load i32, i32* @IPPROTO_TCP
%47 = call i32 @socket(i32 %44, i32 %45, i32 %46)
%48 = icmp slt i32 %47, 0
br i1 %48, label %49, label %52
49: ; preds = %43
%50 = call i32 @perror(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.3, i64 0, i64 0))
%51 = call i32 @exit(i32 1)
unreachable
52: ; preds = %43
%53 = load i32, i32* @IPPROTO_IP
%54 = load i32, i32* @IP_HDRINCL
%55 = call i64 @setsockopt(i32 %47, i32 %53, i32 %54, i32* %4, i32 4)
%56 = icmp eq i64 %55, 0
br i1 %56, label %60, label %57
57: ; preds = %52
%58 = call i32 @perror(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.4, i64 0, i64 0))
%59 = call i32 @exit(i32 1)
unreachable
60: ; preds = %52
%61 = call i32 (...) @getpid()
%62 = call i32 @setuid(i32 %61)
%63 = getelementptr inbounds i8*, i8** %1, i64 3
%64 = load i8*, i8** %63
%65 = call zeroext i16 @atoi(i8* %64)
%66 = call i32 @attack(i32 %47, %struct.sockaddr_in* %3, i16 zeroext %65)
%67 = call i32 @exit(i32 1)
unreachable
}