#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ STDERR_FILENO;
int /*<<< orphan*/ STDOUT_FILENO;
int /*<<< orphan*/ dup2(int /*<<< orphan*/, int /*<<< orphan*/);
int execv(char *, char **);
int /*<<< orphan*/ fileno(int /*<<< orphan*/ *);
char *getenv(char *);
scalar_t__ malloc(scalar_t__);
int /*<<< orphan*/ *popen(char *, char *);
int /*<<< orphan*/ sprintf(char *, char *, char *);
scalar_t__ strlen(char *);
int main(int argc, const char *argv[]) {
  char *executable = NULL;
  char *tee_out_cmd;
  char *tee_err_cmd;
  char *hijacked_stdout = NULL;
  char *hijacked_stderr = NULL;
  char *exec_args[argc + 1];
  int i;
  FILE *hijacked_stdout_fd;
  FILE *hijacked_stderr_fd;
  executable = getenv("REAL_EXECUTABLE");
  exec_args[0] = executable;
  for (i = 1; i < argc; i++) {
    exec_args[i] = (char *)argv[i];
  }
  if (getenv("HIJACK_OUTPUT") != NULL) {
    hijacked_stdout = getenv("HIJACKED_STDOUT");
    hijacked_stderr = getenv("HIJACKED_STDERR");
    tee_out_cmd = (char *)malloc(strlen("tee ") + strlen(hijacked_stdout) + 1);
    tee_err_cmd = (char *)malloc(strlen("tee ") + strlen(hijacked_stderr) + 1);
    sprintf(tee_out_cmd, "tee %s", hijacked_stdout);
    sprintf(tee_err_cmd, "tee %s", hijacked_stderr);
    hijacked_stdout_fd = popen(tee_out_cmd, "w");
    hijacked_stderr_fd = popen(tee_err_cmd, "w");
    dup2(fileno(hijacked_stdout_fd), STDOUT_FILENO);
    dup2(fileno(hijacked_stderr_fd), STDERR_FILENO);
  }
  exec_args[argc] = NULL;
  return execv(executable, exec_args);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x80,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
movq   $0x0,-0x30(%rbp)
movq   $0x0,-0x38(%rbp)
mov    -0x8(%rbp),%eax
add    $0x1,%eax
mov    %rsp,%rcx
mov    %rcx,-0x40(%rbp)
lea    0xf(,%rax,8),%rdx
and    $0xfffffffffffffff0,%rdx
mov    %rsp,%rcx
sub    %rdx,%rcx
mov    %rcx,-0x68(%rbp)
mov    %rcx,%rsp
mov    %rax,-0x48(%rbp)
lea    0xe1e(%rip),%rdi
call   1030 <getenv@plt>
mov    %rax,%rcx
mov    -0x68(%rbp),%rax
mov    %rcx,-0x18(%rbp)
mov    -0x18(%rbp),%rcx
mov    %rcx,(%rax)
movl   $0x1,-0x4c(%rbp)
mov    -0x4c(%rbp),%eax
cmp    -0x8(%rbp),%eax
jge    1232 <main+0xb2>
mov    -0x68(%rbp),%rax
mov    -0x10(%rbp),%rcx
movslq -0x4c(%rbp),%rdx
mov    (%rcx,%rdx,8),%rdx
movslq -0x4c(%rbp),%rcx
mov    %rdx,(%rax,%rcx,8)
mov    -0x4c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x4c(%rbp)
jmp    1200 <main+0x80>
lea    0xdd7(%rip),%rdi
call   1030 <getenv@plt>
cmp    $0x0,%rax
je     1344 <main+0x1c4>
lea    0xdcf(%rip),%rdi
call   1030 <getenv@plt>
mov    %rax,-0x30(%rbp)
lea    0xdcf(%rip),%rdi
call   1030 <getenv@plt>
mov    %rax,-0x38(%rbp)
lea    0xdcf(%rip),%rdi
call   1040 <strlen@plt>
mov    %rax,-0x78(%rbp)
mov    -0x30(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x78(%rbp),%rdi
add    %rax,%rdi
add    $0x1,%rdi
call   1070 <malloc@plt>
mov    %rax,-0x20(%rbp)
lea    0xda2(%rip),%rdi
call   1040 <strlen@plt>
mov    %rax,-0x70(%rbp)
mov    -0x38(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x70(%rbp),%rdi
add    %rax,%rdi
add    $0x1,%rdi
call   1070 <malloc@plt>
mov    %rax,-0x28(%rbp)
mov    -0x20(%rbp),%rdi
mov    -0x30(%rbp),%rdx
lea    0xd72(%rip),%rsi
call   1090 <sprintf@plt>
mov    -0x28(%rbp),%rdi
mov    -0x38(%rbp),%rdx
lea    0xd5e(%rip),%rsi
call   1090 <sprintf@plt>
mov    -0x20(%rbp),%rdi
lea    0xd55(%rip),%rsi
call   1080 <popen@plt>
mov    %rax,-0x58(%rbp)
mov    -0x28(%rbp),%rdi
lea    0xd41(%rip),%rsi
call   1080 <popen@plt>
mov    %rax,-0x60(%rbp)
mov    -0x58(%rbp),%rdi
call   1060 <fileno@plt>
mov    %eax,%edi
mov    0x2ccc(%rip),%rax
mov    (%rax),%esi
call   1050 <dup2@plt>
mov    -0x60(%rbp),%rdi
call   1060 <fileno@plt>
mov    %eax,%edi
mov    0x2c9b(%rip),%rax
mov    (%rax),%esi
call   1050 <dup2@plt>
mov    -0x68(%rbp),%rsi
movslq -0x8(%rbp),%rax
movq   $0x0,(%rsi,%rax,8)
mov    -0x18(%rbp),%rdi
call   10a0 <execv@plt>
mov    %eax,-0x4(%rbp)
mov    -0x40(%rbp),%rax
mov    %rax,%rsp
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %rsi,%r12
mov    %edi,%r15d
lea    0x1(%r15),%eax
mov    %rsp,%r14
lea    0xf(,%rax,8),%rbx
and    $0xfffffffffffffff0,%rbx
mov    %r14,%r13
sub    %rbx,%r13
mov    %r13,%rsp
neg    %rbx
lea    0xe33(%rip),%rdi
call   1030 <getenv@plt>
mov    %rax,-0x38(%rbp)
mov    %rax,(%r14,%rbx,1)
cmp    $0x2,%r15d
jl     11f8 <main+0x68>
lea    0x8(%r13),%rdi
add    $0x8,%r12
lea    -0x1(%r15),%edx
shl    $0x3,%rdx
mov    %r12,%rsi
call   1060 <memcpy@plt>
lea    0xe11(%rip),%rdi
call   1030 <getenv@plt>
test   %rax,%rax
je     12d2 <main+0x142>
lea    0xe0a(%rip),%rdi
call   1030 <getenv@plt>
mov    %rax,%r12
lea    0xe0b(%rip),%rdi
call   1030 <getenv@plt>
mov    %rax,%rbx
mov    %r12,%rdi
call   1040 <strlen@plt>
lea    0x5(%rax),%rdi
call   1080 <malloc@plt>
mov    %r15,-0x30(%rbp)
mov    %rax,%r15
mov    %rbx,%rdi
call   1040 <strlen@plt>
lea    0x5(%rax),%rdi
call   1080 <malloc@plt>
mov    %rax,%r14
lea    0xde0(%rip),%rsi
mov    %r15,%rdi
mov    %r12,%rdx
call   10a0 <sprintf@plt>
mov    %r14,%rdi
lea    0xdcb(%rip),%rsi
mov    %rbx,%rdx
call   10a0 <sprintf@plt>
lea    0xdc3(%rip),%r12
mov    %r15,%rdi
mov    %r12,%rsi
call   1090 <popen@plt>
mov    %rax,%r15
mov    %r14,%rdi
mov    %r12,%rsi
call   1090 <popen@plt>
mov    %rax,%r14
mov    %r15,%rdi
mov    -0x30(%rbp),%r15
call   1070 <fileno@plt>
mov    0x2d3f(%rip),%rcx
mov    (%rcx),%esi
mov    %eax,%edi
call   1050 <dup2@plt>
mov    %r14,%rdi
call   1070 <fileno@plt>
mov    0x2d0f(%rip),%rcx
mov    (%rcx),%esi
mov    %eax,%edi
call   1050 <dup2@plt>
movslq %r15d,%rax
movq   $0x0,0x0(%r13,%rax,8)
mov    -0x38(%rbp),%rdi
mov    %r13,%rsi
call   10b0 <execv@plt>
lea    -0x28(%rbp),%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [16 x i8] c"REAL_EXECUTABLE\00"
@.str.1 = [14 x i8] c"HIJACK_OUTPUT\00"
@.str.2 = [16 x i8] c"HIJACKED_STDOUT\00"
@.str.3 = [16 x i8] c"HIJACKED_STDERR\00"
@.str.4 = [5 x i8] c"tee \00"
@.str.5 = [7 x i8] c"tee %s\00"
@.str.6 = [2 x i8] c"w\00"
@STDOUT_FILENO = global i32 0
@STDERR_FILENO = global i32 0
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i8*
%11 = alloca i8*
%12 = alloca i64
%13 = alloca i32
%14 = alloca i32*
%15 = alloca i32*
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i8* null, i8** %6
store i8* null, i8** %9
store i8* null, i8** %10
%16 = load i32, i32* %4
%17 = add nsw i32 %16, 1
%18 = zext i32 %17 to i64
%19 = call i8* @llvm.stacksave()
store i8* %19, i8** %11
%20 = alloca i8*, i64 %18
store i64 %18, i64* %12
%21 = call i8* @getenv(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str, i64 0, i64 0))
store i8* %21, i8** %6
%22 = load i8*, i8** %6
%23 = getelementptr inbounds i8*, i8** %20, i64 0
store i8* %22, i8** %23
store i32 1, i32* %13
br label %24
24: ; preds = %37, %2
%25 = load i32, i32* %13
%26 = load i32, i32* %4
%27 = icmp slt i32 %25, %26
br i1 %27, label %28, label %40
28: ; preds = %24
%29 = load i8**, i8*** %5
%30 = load i32, i32* %13
%31 = sext i32 %30 to i64
%32 = getelementptr inbounds i8*, i8** %29, i64 %31
%33 = load i8*, i8** %32
%34 = load i32, i32* %13
%35 = sext i32 %34 to i64
%36 = getelementptr inbounds i8*, i8** %20, i64 %35
store i8* %33, i8** %36
br label %37
37: ; preds = %28
%38 = load i32, i32* %13
%39 = add nsw i32 %38, 1
store i32 %39, i32* %13
br label %24
40: ; preds = %24
%41 = call i8* @getenv(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0))
%42 = icmp ne i8* %41, null
br i1 %42, label %43, label %78
43: ; preds = %40
%44 = call i8* @getenv(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0))
store i8* %44, i8** %9
%45 = call i8* @getenv(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.3, i64 0, i64 0))
store i8* %45, i8** %10
%46 = call i64 @strlen(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.4, i64 0, i64 0))
%47 = load i8*, i8** %9
%48 = call i64 @strlen(i8* %47)
%49 = add nsw i64 %46, %48
%50 = add nsw i64 %49, 1
%51 = call i64 @malloc(i64 %50)
%52 = inttoptr i64 %51 to i8*
store i8* %52, i8** %7
%53 = call i64 @strlen(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.4, i64 0, i64 0))
%54 = load i8*, i8** %10
%55 = call i64 @strlen(i8* %54)
%56 = add nsw i64 %53, %55
%57 = add nsw i64 %56, 1
%58 = call i64 @malloc(i64 %57)
%59 = inttoptr i64 %58 to i8*
store i8* %59, i8** %8
%60 = load i8*, i8** %7
%61 = load i8*, i8** %9
%62 = call i32 @sprintf(i8* %60, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.5, i64 0, i64 0), i8* %61)
%63 = load i8*, i8** %8
%64 = load i8*, i8** %10
%65 = call i32 @sprintf(i8* %63, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.5, i64 0, i64 0), i8* %64)
%66 = load i8*, i8** %7
%67 = call i32* @popen(i8* %66, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.6, i64 0, i64 0))
store i32* %67, i32** %14
%68 = load i8*, i8** %8
%69 = call i32* @popen(i8* %68, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.6, i64 0, i64 0))
store i32* %69, i32** %15
%70 = load i32*, i32** %14
%71 = call i32 @fileno(i32* %70)
%72 = load i32, i32* @STDOUT_FILENO
%73 = call i32 @dup2(i32 %71, i32 %72)
%74 = load i32*, i32** %15
%75 = call i32 @fileno(i32* %74)
%76 = load i32, i32* @STDERR_FILENO
%77 = call i32 @dup2(i32 %75, i32 %76)
br label %78
78: ; preds = %43, %40
%79 = load i32, i32* %4
%80 = sext i32 %79 to i64
%81 = getelementptr inbounds i8*, i8** %20, i64 %80
store i8* null, i8** %81
%82 = load i8*, i8** %6
%83 = call i32 @execv(i8* %82, i8** %20)
store i32 %83, i32* %3
%84 = load i8*, i8** %11
%85 = load i32, i32* %3
ret i32 %85
}

LLVM IR (-O2):
@.str = [16 x i8] c"REAL_EXECUTABLE\00"
@.str.1 = [14 x i8] c"HIJACK_OUTPUT\00"
@.str.2 = [16 x i8] c"HIJACKED_STDOUT\00"
@.str.3 = [16 x i8] c"HIJACKED_STDERR\00"
@.str.5 = [7 x i8] c"tee %s\00"
@.str.6 = [2 x i8] c"w\00"
@STDOUT_FILENO = global i32 0
@STDERR_FILENO = global i32 0
define i32 @main(i32 %0, i8** nocapture %1) {
%3 = add nsw i32 %0, 1
%4 = zext i32 %3 to i64
%5 = alloca i8*, i64 %4
%6 = tail call i8* @getenv(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str, i64 0, i64 0))
store i8* %6, i8** %5
%7 = icmp sgt i32 %0, 1
br i1 %7, label %8, label %16
8: ; preds = %2
%9 = getelementptr inbounds i8*, i8** %5, i64 1
%10 = bitcast i8** %9 to i8*
%11 = getelementptr i8*, i8** %1, i64 1
%12 = bitcast i8** %11 to i8*
%13 = add nsw i32 %0, -1
%14 = zext i32 %13 to i64
%15 = shl nuw nsw i64 %14, 3
br label %16
16: ; preds = %8, %2
%17 = tail call i8* @getenv(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.1, i64 0, i64 0))
%18 = icmp eq i8* %17, null
br i1 %18, label %40, label %19
19: ; preds = %16
%20 = tail call i8* @getenv(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.2, i64 0, i64 0))
%21 = tail call i8* @getenv(i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.3, i64 0, i64 0))
%22 = tail call i64 @strlen(i8* dereferenceable(1) %20)
%23 = add nsw i64 %22, 5
%24 = tail call i64 @malloc(i64 %23)
%25 = inttoptr i64 %24 to i8*
%26 = tail call i64 @strlen(i8* dereferenceable(1) %21)
%27 = add nsw i64 %26, 5
%28 = tail call i64 @malloc(i64 %27)
%29 = inttoptr i64 %28 to i8*
%30 = tail call i32 @sprintf(i8* dereferenceable(1) %25, i8* dereferenceable(1) getelementptr inbounds ([7 x i8], [7 x i8]* @.str.5, i64 0, i64 0), i8* %20)
%31 = tail call i32 @sprintf(i8* dereferenceable(1) %29, i8* dereferenceable(1) getelementptr inbounds ([7 x i8], [7 x i8]* @.str.5, i64 0, i64 0), i8* %21)
%32 = tail call i32* @popen(i8* %25, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.6, i64 0, i64 0))
%33 = tail call i32* @popen(i8* %29, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.6, i64 0, i64 0))
%34 = tail call i32 @fileno(i32* %32)
%35 = load i32, i32* @STDOUT_FILENO
%36 = tail call i32 @dup2(i32 %34, i32 %35)
%37 = tail call i32 @fileno(i32* %33)
%38 = load i32, i32* @STDERR_FILENO
%39 = tail call i32 @dup2(i32 %37, i32 %38)
br label %40
40: ; preds = %19, %16
%41 = sext i32 %0 to i64
%42 = getelementptr inbounds i8*, i8** %5, i64 %41
store i8* null, i8** %42
%43 = call i32 @execv(i8* %6, i8** %5)
ret i32 %43
}