#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef scalar_t__ pid_t;

/* Variables and functions */
int /*<<< orphan*/ __environ;
int /*<<< orphan*/ _exit(int);
int /*<<< orphan*/ execve(char *, char **, int /*<<< orphan*/);
scalar_t__ fork();
int /*<<< orphan*/ waitpid(scalar_t__, int *, int /*<<< orphan*/);
int system(char *cmd) {
  char *argv[4];
  argv[0] = "/system/bin/sh";
  argv[1] = "-c";
  argv[2] = cmd;
  argv[3] = NULL;
  pid_t pid = fork();
  if (pid == 0) {
    execve(argv[0], argv, __environ);
    argv[0] = "/bin/sh";
    execve(argv[0], argv, __environ);
    _exit(-1);
  }
  int status;
  waitpid(pid, &status, 0);
  return status;
}


x86 assembly (clang, -O0):
<system>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x8(%rbp)
lea    0xead(%rip),%rax
mov    %rax,-0x30(%rbp)
lea    0xeb1(%rip),%rax
mov    %rax,-0x28(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0x20(%rbp)
movq   $0x0,-0x18(%rbp)
mov    $0x0,%al
call   1060 <fork@plt>
mov    %rax,-0x38(%rbp)
cmpq   $0x0,-0x38(%rbp)
jne    11c9 <system+0x89>
mov    -0x30(%rbp),%rdi
lea    -0x30(%rbp),%rsi
mov    0x2e61(%rip),%rax
mov    (%rax),%edx
call   1040 <execve@plt>
lea    0xe62(%rip),%rax
mov    %rax,-0x30(%rbp)
mov    -0x30(%rbp),%rdi
lea    -0x30(%rbp),%rsi
mov    0x2e40(%rip),%rax
mov    (%rax),%edx
call   1040 <execve@plt>
mov    $0xffffffff,%edi
call   1030 <_exit@plt>
mov    -0x38(%rbp),%rdi
lea    -0x3c(%rbp),%rsi
xor    %edx,%edx
call   1050 <waitpid@plt>
mov    -0x3c(%rbp),%eax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<system>:
push   %r14
push   %rbx
sub    $0x38,%rsp
lea    0xeb2(%rip),%rax
mov    %rax,0x10(%rsp)
lea    0xeb5(%rip),%rax
mov    %rax,0x18(%rsp)
mov    %rdi,0x20(%rsp)
movq   $0x0,0x28(%rsp)
xor    %eax,%eax
call   1060 <fork@plt>
test   %rax,%rax
je     1194 <system+0x54>
lea    0xc(%rsp),%rsi
mov    %rax,%rdi
xor    %edx,%edx
call   1050 <waitpid@plt>
mov    0xc(%rsp),%eax
add    $0x38,%rsp
pop    %rbx
pop    %r14
ret
mov    0x2e5d(%rip),%r14
mov    (%r14),%edx
lea    0xe5b(%rip),%rdi
lea    0x10(%rsp),%rbx
mov    %rbx,%rsi
call   1040 <execve@plt>
lea    0xe4e(%rip),%rdi
mov    %rdi,0x10(%rsp)
mov    (%r14),%edx
mov    %rbx,%rsi
call   1040 <execve@plt>
mov    $0xffffffff,%edi
call   1030 <_exit@plt>

LLVM IR (-O0):
@.str = [15 x i8] c"/system/bin/sh\00"
@.str.1 = [3 x i8] c"-c\00"
@__environ = global i32 0
@.str.2 = [8 x i8] c"/bin/sh\00"
define i32 @system(i8* %0) {
%2 = alloca i8*
%3 = alloca [4 x i8*]
%4 = alloca i64
%5 = alloca i32
store i8* %0, i8** %2
%6 = getelementptr inbounds [4 x i8*], [4 x i8*]* %3, i64 0, i64 0
store i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str, i64 0, i64 0), i8** %6
%7 = getelementptr inbounds [4 x i8*], [4 x i8*]* %3, i64 0, i64 1
store i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8** %7
%8 = load i8*, i8** %2
%9 = getelementptr inbounds [4 x i8*], [4 x i8*]* %3, i64 0, i64 2
store i8* %8, i8** %9
%10 = getelementptr inbounds [4 x i8*], [4 x i8*]* %3, i64 0, i64 3
store i8* null, i8** %10
%11 = call i64 (...) @fork()
store i64 %11, i64* %4
%12 = load i64, i64* %4
%13 = icmp eq i64 %12, 0
br i1 %13, label %14, label %27
14: ; preds = %1
%15 = getelementptr inbounds [4 x i8*], [4 x i8*]* %3, i64 0, i64 0
%16 = load i8*, i8** %15
%17 = getelementptr inbounds [4 x i8*], [4 x i8*]* %3, i64 0, i64 0
%18 = load i32, i32* @__environ
%19 = call i32 @execve(i8* %16, i8** %17, i32 %18)
%20 = getelementptr inbounds [4 x i8*], [4 x i8*]* %3, i64 0, i64 0
store i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0), i8** %20
%21 = getelementptr inbounds [4 x i8*], [4 x i8*]* %3, i64 0, i64 0
%22 = load i8*, i8** %21
%23 = getelementptr inbounds [4 x i8*], [4 x i8*]* %3, i64 0, i64 0
%24 = load i32, i32* @__environ
%25 = call i32 @execve(i8* %22, i8** %23, i32 %24)
%26 = call i32 @_exit(i32 -1)
unreachable
27: ; preds = %1
%28 = load i64, i64* %4
%29 = call i32 @waitpid(i64 %28, i32* %5, i32 0)
%30 = load i32, i32* %5
ret i32 %30
}

LLVM IR (-O2):
@.str = [15 x i8] c"/system/bin/sh\00"
@.str.1 = [3 x i8] c"-c\00"
@__environ = global i32 0
@.str.2 = [8 x i8] c"/bin/sh\00"
define i32 @system(i8* %0) {
%2 = alloca [4 x i8*]
%3 = alloca i32
%4 = bitcast [4 x i8*]* %2 to i8*
%5 = getelementptr inbounds [4 x i8*], [4 x i8*]* %2, i64 0, i64 0
store i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str, i64 0, i64 0), i8** %5
%6 = getelementptr inbounds [4 x i8*], [4 x i8*]* %2, i64 0, i64 1
store i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8** %6
%7 = getelementptr inbounds [4 x i8*], [4 x i8*]* %2, i64 0, i64 2
store i8* %0, i8** %7
%8 = getelementptr inbounds [4 x i8*], [4 x i8*]* %2, i64 0, i64 3
store i8* null, i8** %8
%9 = tail call i64 (...) @fork()
%10 = icmp eq i64 %9, 0
br i1 %10, label %11, label %17
11: ; preds = %1
%12 = load i32, i32* @__environ
%13 = call i32 @execve(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str, i64 0, i64 0), i8** %5, i32 %12)
store i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0), i8** %5
%14 = load i32, i32* @__environ
%15 = call i32 @execve(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0), i8** %5, i32 %14)
%16 = call i32 @_exit(i32 -1)
unreachable
17: ; preds = %1
%18 = bitcast i32* %3 to i8*
%19 = call i32 @waitpid(i64 %9, i32* %3, i32 0)
%20 = load i32, i32* %3
ret i32 %20
}