#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef scalar_t__ uint8_t;
typedef scalar_t__ uint16_t;
struct iphdr {
  int ihl;
  int version;
  int protocol;
  int ttl;
  void *daddr;
  void *saddr;
  void *tot_len;
  scalar_t__ frag_off;
};
struct ethhdr {
  void *h_proto;
};

/* Variables and functions */
int ETH_ALEN;
scalar_t__ ETH_P_IP;
int /*<<< orphan*/ INADDR_LOOPBACK;
void *htonl(int /*<<< orphan*/);
void *htons(scalar_t__);
int /*<<< orphan*/ memset(void *, char, int);
scalar_t__ rand();
void create_payload(void *pay, size_t *len) {
  int i;
  struct ethhdr *eth = pay;
  struct iphdr *ip = pay + sizeof(*eth);
  *len = 100 + 42;
  memset(pay, 0xff, ETH_ALEN * 2);
  eth->h_proto = htons(ETH_P_IP);
  for (i = 0; i < sizeof(*ip); ++i) {
    ((uint8_t *)pay)[i + sizeof(*eth)] = (uint8_t)rand();
  }
  ip->ihl = 5;
  ip->version = 4;
  ip->protocol = 0x11;
  ip->frag_off = 0;
  ip->ttl = 64;
  ip->tot_len = htons((uint16_t)*len - sizeof(*eth));
  ip->saddr = htonl(INADDR_LOOPBACK);
  ip->daddr = htonl(INADDR_LOOPBACK);
  memset(pay + sizeof(*eth) + sizeof(*ip), 'a', 100);
}


x86 assembly (clang, -O0):
<create_payload>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x8(%rbp),%rax
add    $0x8,%rax
mov    %rax,-0x28(%rbp)
mov    -0x10(%rbp),%rax
movq   $0x8e,(%rax)
mov    -0x8(%rbp),%rdi
mov    0x2e6e(%rip),%rax
mov    (%rax),%edx
shl    $0x1,%edx
mov    $0xffffffff,%esi
call   1050 <memset@plt>
mov    0x2e40(%rip),%rax
mov    (%rax),%rdi
call   1030 <htons@plt>
mov    %rax,%rcx
mov    -0x20(%rbp),%rax
mov    %rcx,(%rax)
movl   $0x0,-0x14(%rbp)
movslq -0x14(%rbp),%rax
cmp    $0x30,%rax
jae    11dc <create_payload+0x9c>
mov    $0x0,%al
call   1060 <rand@plt>
mov    %rax,%rdx
mov    -0x8(%rbp),%rax
movslq -0x14(%rbp),%rcx
mov    %rdx,0x40(%rax,%rcx,8)
mov    -0x14(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x14(%rbp)
jmp    11a9 <create_payload+0x69>
mov    -0x28(%rbp),%rax
movl   $0x5,(%rax)
mov    -0x28(%rbp),%rax
movl   $0x4,0x4(%rax)
mov    -0x28(%rbp),%rax
movl   $0x11,0x8(%rax)
mov    -0x28(%rbp),%rax
movq   $0x0,0x28(%rax)
mov    -0x28(%rbp),%rax
movl   $0x40,0xc(%rax)
mov    -0x10(%rbp),%rax
mov    (%rax),%rdi
sub    $0x8,%rdi
call   1030 <htons@plt>
mov    %rax,%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,0x20(%rax)
mov    0x2dab(%rip),%rax
mov    (%rax),%edi
call   1040 <htonl@plt>
mov    %rax,%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,0x18(%rax)
mov    0x2d92(%rip),%rax
mov    (%rax),%edi
call   1040 <htonl@plt>
mov    %rax,%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,0x10(%rax)
mov    -0x8(%rbp),%rdi
add    $0x8,%rdi
add    $0x30,%rdi
mov    $0x61,%esi
mov    $0x64,%edx
call   1050 <memset@plt>
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<create_payload>:
push   %r15
push   %r14
push   %rbx
mov    %rsi,%r14
mov    %rdi,%r15
movq   $0x8e,(%rsi)
mov    0x2e8f(%rip),%rax
mov    (%rax),%edx
add    %edx,%edx
mov    $0xffffffff,%esi
call   1050 <memset@plt>
mov    0x2e62(%rip),%rax
mov    (%rax),%rdi
call   1030 <htons@plt>
mov    %rax,(%r15)
mov    $0x8,%ebx
xchg   %ax,%ax
xor    %eax,%eax
call   1060 <rand@plt>
mov    %rax,(%r15,%rbx,8)
add    $0x1,%rbx
cmp    $0x38,%rbx
jne    1180 <create_payload+0x40>
movq   $0x0,0x30(%r15)
movaps 0xe5c(%rip),%xmm0
movups %xmm0,0x8(%r15)
mov    (%r14),%rdi
add    $0xfffffffffffffff8,%rdi
call   1030 <htons@plt>
mov    %rax,0x28(%r15)
mov    0x2e20(%rip),%rbx
mov    (%rbx),%edi
call   1040 <htonl@plt>
mov    %rax,0x20(%r15)
mov    (%rbx),%edi
call   1040 <htonl@plt>
mov    %rax,0x18(%r15)
add    $0x38,%r15
mov    %r15,%rdi
mov    $0x61,%esi
mov    $0x64,%edx
pop    %rbx
pop    %r14
pop    %r15
jmp    1050 <memset@plt>

LLVM IR (-O0):
%struct.ethhdr = type { i8* }
%struct.iphdr = type { i32, i32, i32, i32, i8*, i8*, i8*, i64 }
@ETH_ALEN = global i32 0
@ETH_P_IP = global i64 0
@INADDR_LOOPBACK = global i32 0
define void @create_payload(i8* %0, i64* %1) {
%3 = alloca i8*
%4 = alloca i64*
%5 = alloca i32
%6 = alloca %struct.ethhdr*
%7 = alloca %struct.iphdr*
store i8* %0, i8** %3
store i64* %1, i64** %4
%8 = load i8*, i8** %3
%9 = bitcast i8* %8 to %struct.ethhdr*
store %struct.ethhdr* %9, %struct.ethhdr** %6
%10 = load i8*, i8** %3
%11 = getelementptr i8, i8* %10, i64 8
%12 = bitcast i8* %11 to %struct.iphdr*
store %struct.iphdr* %12, %struct.iphdr** %7
%13 = load i64*, i64** %4
store i64 142, i64* %13
%14 = load i8*, i8** %3
%15 = load i32, i32* @ETH_ALEN
%16 = mul nsw i32 %15, 2
%17 = call i32 @memset(i8* %14, i8 signext -1, i32 %16)
%18 = load i64, i64* @ETH_P_IP
%19 = call i8* @htons(i64 %18)
%20 = load %struct.ethhdr*, %struct.ethhdr** %6
%21 = getelementptr inbounds %struct.ethhdr, %struct.ethhdr* %20, i32 0, i32 0
store i8* %19, i8** %21
store i32 0, i32* %5
br label %22
22: ; preds = %34, %2
%23 = load i32, i32* %5
%24 = sext i32 %23 to i64
%25 = icmp ult i64 %24, 48
br i1 %25, label %26, label %37
26: ; preds = %22
%27 = call i64 (...) @rand()
%28 = load i8*, i8** %3
%29 = bitcast i8* %28 to i64*
%30 = load i32, i32* %5
%31 = sext i32 %30 to i64
%32 = add i64 %31, 8
%33 = getelementptr inbounds i64, i64* %29, i64 %32
store i64 %27, i64* %33
br label %34
34: ; preds = %26
%35 = load i32, i32* %5
%36 = add nsw i32 %35, 1
store i32 %36, i32* %5
br label %22
37: ; preds = %22
%38 = load %struct.iphdr*, %struct.iphdr** %7
%39 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %38, i32 0, i32 0
store i32 5, i32* %39
%40 = load %struct.iphdr*, %struct.iphdr** %7
%41 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %40, i32 0, i32 1
store i32 4, i32* %41
%42 = load %struct.iphdr*, %struct.iphdr** %7
%43 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %42, i32 0, i32 2
store i32 17, i32* %43
%44 = load %struct.iphdr*, %struct.iphdr** %7
%45 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %44, i32 0, i32 7
store i64 0, i64* %45
%46 = load %struct.iphdr*, %struct.iphdr** %7
%47 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %46, i32 0, i32 3
store i32 64, i32* %47
%48 = load i64*, i64** %4
%49 = load i64, i64* %48
%50 = sub i64 %49, 8
%51 = call i8* @htons(i64 %50)
%52 = load %struct.iphdr*, %struct.iphdr** %7
%53 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %52, i32 0, i32 6
store i8* %51, i8** %53
%54 = load i32, i32* @INADDR_LOOPBACK
%55 = call i8* @htonl(i32 %54)
%56 = load %struct.iphdr*, %struct.iphdr** %7
%57 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %56, i32 0, i32 5
store i8* %55, i8** %57
%58 = load i32, i32* @INADDR_LOOPBACK
%59 = call i8* @htonl(i32 %58)
%60 = load %struct.iphdr*, %struct.iphdr** %7
%61 = getelementptr inbounds %struct.iphdr, %struct.iphdr* %60, i32 0, i32 4
store i8* %59, i8** %61
%62 = load i8*, i8** %3
%63 = getelementptr i8, i8* %62, i64 8
%64 = getelementptr i8, i8* %63, i64 48
%65 = call i32 @memset(i8* %64, i8 signext 97, i32 100)
ret void
}

LLVM IR (-O2):
@ETH_ALEN = global i32 0
@ETH_P_IP = global i64 0
@INADDR_LOOPBACK = global i32 0
define void @create_payload(i8* %0, i64* nocapture %1) {
store i64 142, i64* %1
%3 = load i32, i32* @ETH_ALEN
%4 = shl nsw i32 %3, 1
%5 = tail call i32 @memset(i8* %0, i8 signext -1, i32 %4)
%6 = load i64, i64* @ETH_P_IP
%7 = tail call i8* @htons(i64 %6)
%8 = bitcast i8* %0 to i8**
store i8* %7, i8** %8
%9 = bitcast i8* %0 to i64*
br label %10
10: ; preds = %2, %10
%11 = phi i64 [ 0, %2 ], [ %15, %10 ]
%12 = tail call i64 (...) @rand()
%13 = add nuw nsw i64 %11, 8
%14 = getelementptr inbounds i64, i64* %9, i64 %13
store i64 %12, i64* %14
%15 = add nuw nsw i64 %11, 1
%16 = icmp eq i64 %15, 48
br i1 %16, label %17, label %10
17: ; preds = %10
%18 = getelementptr i8, i8* %0, i64 8
%19 = getelementptr i8, i8* %0, i64 48
%20 = bitcast i8* %19 to i64*
store i64 0, i64* %20
%21 = bitcast i8* %18 to <4 x i32>*
store <4 x i32> <i32 5, i32 4, i32 17, i32 64>, <4 x i32>* %21
%22 = load i64, i64* %1
%23 = add i64 %22, -8
%24 = tail call i8* @htons(i64 %23)
%25 = getelementptr i8, i8* %0, i64 40
%26 = bitcast i8* %25 to i8**
store i8* %24, i8** %26
%27 = load i32, i32* @INADDR_LOOPBACK
%28 = tail call i8* @htonl(i32 %27)
%29 = getelementptr i8, i8* %0, i64 32
%30 = bitcast i8* %29 to i8**
store i8* %28, i8** %30
%31 = load i32, i32* @INADDR_LOOPBACK
%32 = tail call i8* @htonl(i32 %31)
%33 = getelementptr i8, i8* %0, i64 24
%34 = bitcast i8* %33 to i8**
store i8* %32, i8** %34
%35 = getelementptr i8, i8* %0, i64 56
%36 = tail call i32 @memset(i8* %35, i8 signext 97, i32 100)
ret void
}