#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ execve(char const *, char **, char **);
int /*<<< orphan*/ memmove(char const **, char const **, int);
void execve_as_traditional_shell_script(const char *file, const char *argv[],
                                        const char *const envp[]) {
  const char *argv0 = argv[0];
  const char *const *end = argv;
  while (*end != NULL)
    ++end;
  memmove(argv + 2, argv + 1, (end - argv) * sizeof(*end));
  argv[0] = "/bin/sh";
  argv[1] = file;
  execve(argv[0], (char **)argv, (char **)envp);
  memmove(argv + 1, argv + 2, (end - argv) * sizeof(*end));
  argv[0] = argv0;
}


x86 assembly (clang, -O0):
<execve_as_traditional_shell_script>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x20(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
cmpq   $0x0,(%rax)
je     1166 <execve_as_traditional_shell_script+0x46>
mov    -0x28(%rbp),%rax
add    $0x8,%rax
mov    %rax,-0x28(%rbp)
jmp    1147 <execve_as_traditional_shell_script+0x27>
mov    -0x10(%rbp),%rdi
add    $0x10,%rdi
mov    -0x10(%rbp),%rsi
add    $0x8,%rsi
mov    -0x28(%rbp),%rax
mov    -0x10(%rbp),%rcx
sub    %rcx,%rax
sar    $0x3,%rax
shl    $0x3,%rax
mov    %eax,%edx
call   1040 <memmove@plt>
mov    -0x10(%rbp),%rax
lea    0xe65(%rip),%rcx
mov    %rcx,(%rax)
mov    -0x8(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x10(%rbp),%rax
mov    (%rax),%rdi
mov    -0x10(%rbp),%rsi
mov    -0x18(%rbp),%rdx
call   1030 <execve@plt>
mov    -0x10(%rbp),%rdi
add    $0x8,%rdi
mov    -0x10(%rbp),%rsi
add    $0x10,%rsi
mov    -0x28(%rbp),%rax
mov    -0x10(%rbp),%rcx
sub    %rcx,%rax
sar    $0x3,%rax
shl    $0x3,%rax
mov    %eax,%edx
call   1040 <memmove@plt>
mov    -0x20(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,(%rax)
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<execve_as_traditional_shell_script>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %rdx,(%rsp)
mov    %rsi,%r15
mov    %rdi,%r12
mov    (%rsi),%r14
mov    %rsi,%rbx
test   %r14,%r14
je     115e <execve_as_traditional_shell_script+0x3e>
mov    %r15,%rax
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
lea    0x8(%rax),%rbx
cmpq   $0x0,0x8(%rax)
mov    %rbx,%rax
jne    1150 <execve_as_traditional_shell_script+0x30>
lea    0x10(%r15),%r13
lea    0x8(%r15),%rbp
sub    %r15d,%ebx
mov    %r13,%rdi
mov    %rbp,%rsi
mov    %ebx,%edx
call   1040 <memmove@plt>
lea    0xe83(%rip),%rdi
mov    %rdi,(%r15)
mov    %r12,0x8(%r15)
mov    %r15,%rsi
mov    (%rsp),%rdx
call   1030 <execve@plt>
mov    %rbp,%rdi
mov    %r13,%rsi
mov    %ebx,%edx
call   1040 <memmove@plt>
mov    %r14,(%r15)
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [8 x i8] c"/bin/sh\00"
define void @execve_as_traditional_shell_script(i8* %0, i8** %1, i8** %2) {
%4 = alloca i8*
%5 = alloca i8**
%6 = alloca i8**
%7 = alloca i8*
%8 = alloca i8**
store i8* %0, i8** %4
store i8** %1, i8*** %5
store i8** %2, i8*** %6
%9 = load i8**, i8*** %5
%10 = getelementptr inbounds i8*, i8** %9, i64 0
%11 = load i8*, i8** %10
store i8* %11, i8** %7
%12 = load i8**, i8*** %5
store i8** %12, i8*** %8
br label %13
13: ; preds = %17, %3
%14 = load i8**, i8*** %8
%15 = load i8*, i8** %14
%16 = icmp ne i8* %15, null
br i1 %16, label %17, label %20
17: ; preds = %13
%18 = load i8**, i8*** %8
%19 = getelementptr inbounds i8*, i8** %18, i32 1
store i8** %19, i8*** %8
br label %13
20: ; preds = %13
%21 = load i8**, i8*** %5
%22 = getelementptr inbounds i8*, i8** %21, i64 2
%23 = load i8**, i8*** %5
%24 = getelementptr inbounds i8*, i8** %23, i64 1
%25 = load i8**, i8*** %8
%26 = load i8**, i8*** %5
%27 = ptrtoint i8** %25 to i64
%28 = ptrtoint i8** %26 to i64
%29 = sub i64 %27, %28
%30 = sdiv exact i64 %29, 8
%31 = mul i64 %30, 8
%32 = trunc i64 %31 to i32
%33 = call i32 @memmove(i8** %22, i8** %24, i32 %32)
%34 = load i8**, i8*** %5
%35 = getelementptr inbounds i8*, i8** %34, i64 0
store i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8** %35
%36 = load i8*, i8** %4
%37 = load i8**, i8*** %5
%38 = getelementptr inbounds i8*, i8** %37, i64 1
store i8* %36, i8** %38
%39 = load i8**, i8*** %5
%40 = getelementptr inbounds i8*, i8** %39, i64 0
%41 = load i8*, i8** %40
%42 = load i8**, i8*** %5
%43 = load i8**, i8*** %6
%44 = call i32 @execve(i8* %41, i8** %42, i8** %43)
%45 = load i8**, i8*** %5
%46 = getelementptr inbounds i8*, i8** %45, i64 1
%47 = load i8**, i8*** %5
%48 = getelementptr inbounds i8*, i8** %47, i64 2
%49 = load i8**, i8*** %8
%50 = load i8**, i8*** %5
%51 = ptrtoint i8** %49 to i64
%52 = ptrtoint i8** %50 to i64
%53 = sub i64 %51, %52
%54 = sdiv exact i64 %53, 8
%55 = mul i64 %54, 8
%56 = trunc i64 %55 to i32
%57 = call i32 @memmove(i8** %46, i8** %48, i32 %56)
%58 = load i8*, i8** %7
%59 = load i8**, i8*** %5
%60 = getelementptr inbounds i8*, i8** %59, i64 0
store i8* %58, i8** %60
ret void
}

LLVM IR (-O2):
@.str = [8 x i8] c"/bin/sh\00"
define void @execve_as_traditional_shell_script(i8* %0, i8** %1, i8** %2) {
%4 = load i8*, i8** %1
%5 = icmp eq i8* %4, null
br i1 %5, label %11, label %6
6: ; preds = %3, %6
%7 = phi i8** [ %8, %6 ], [ %1, %3 ]
%8 = getelementptr inbounds i8*, i8** %7, i64 1
%9 = load i8*, i8** %8
%10 = icmp eq i8* %9, null
br i1 %10, label %11, label %6
11: ; preds = %6, %3
%12 = phi i8** [ %1, %3 ], [ %8, %6 ]
%13 = getelementptr inbounds i8*, i8** %1, i64 2
%14 = getelementptr inbounds i8*, i8** %1, i64 1
%15 = ptrtoint i8** %12 to i64
%16 = ptrtoint i8** %1 to i64
%17 = sub i64 %15, %16
%18 = trunc i64 %17 to i32
%19 = tail call i32 @memmove(i8** %13, i8** %14, i32 %18)
store i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8** %1
store i8* %0, i8** %14
%20 = tail call i32 @execve(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8** %1, i8** %2)
%21 = tail call i32 @memmove(i8** %14, i8** %13, i32 %18)
store i8* %4, i8** %1
ret void
}