#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
char *InstanceStr();
int /*<<< orphan*/ TryExecHomeAdbShell(char **);
int /*<<< orphan*/ execv(char *, char **);
void *malloc(size_t);
int /*<<< orphan*/ snprintf(char *, size_t, char *, char *);
int strlen(char *);
int main(int argc, char *argv[]) {
  TryExecHomeAdbShell(argv);
  char **new_argv = malloc((argc + 5) * sizeof(*new_argv));
  new_argv[0] = "/usr/bin/adb";
  new_argv[1] = "-s";
  new_argv[2] = InstanceStr();
  new_argv[3] = "shell";
  new_argv[4] = "/system/bin/sh";
  if (argc == 1) {
    new_argv[4] = NULL;
  }
  for (int i = 1; i < argc; ++i) {
    size_t buf_size = strlen(argv[i]) + 4;
    new_argv[i + 4] = malloc(buf_size);
    snprintf(new_argv[i + 4], buf_size, "\"%s\"", argv[i]);
  }
  new_argv[argc + 4] = NULL;
  execv(new_argv[0], new_argv);
  return 2;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    -0x10(%rbp),%rdi
call   1070 <TryExecHomeAdbShell@plt>
mov    -0x8(%rbp),%eax
add    $0x5,%eax
movslq %eax,%rdi
shl    $0x3,%rdi
call   1060 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rax
lea    0xe60(%rip),%rcx
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rax
lea    0xe5f(%rip),%rcx
mov    %rcx,0x8(%rax)
mov    $0x0,%al
call   1050 <InstanceStr@plt>
mov    %rax,%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,0x10(%rax)
mov    -0x18(%rbp),%rax
lea    0xe41(%rip),%rcx
mov    %rcx,0x18(%rax)
mov    -0x18(%rbp),%rax
lea    0xe38(%rip),%rcx
mov    %rcx,0x20(%rax)
cmpl   $0x1,-0x8(%rbp)
jne    11f8 <main+0x98>
mov    -0x18(%rbp),%rax
movq   $0x0,0x20(%rax)
movl   $0x1,-0x1c(%rbp)
mov    -0x1c(%rbp),%eax
cmp    -0x8(%rbp),%eax
jge    127d <main+0x11d>
mov    -0x10(%rbp),%rax
movslq -0x1c(%rbp),%rcx
mov    (%rax,%rcx,8),%rdi
call   1030 <strlen@plt>
add    $0x4,%eax
cltq
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rdi
call   1060 <malloc@plt>
mov    %rax,%rdx
mov    -0x18(%rbp),%rax
mov    -0x1c(%rbp),%ecx
add    $0x4,%ecx
movslq %ecx,%rcx
mov    %rdx,(%rax,%rcx,8)
mov    -0x18(%rbp),%rax
mov    -0x1c(%rbp),%ecx
add    $0x4,%ecx
movslq %ecx,%rcx
mov    (%rax,%rcx,8),%rdi
mov    -0x28(%rbp),%rsi
mov    -0x10(%rbp),%rax
movslq -0x1c(%rbp),%rcx
mov    (%rax,%rcx,8),%rcx
lea    0xdbb(%rip),%rdx
call   1040 <snprintf@plt>
mov    -0x1c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    11ff <main+0x9f>
mov    -0x18(%rbp),%rax
mov    -0x8(%rbp),%ecx
add    $0x4,%ecx
movslq %ecx,%rcx
movq   $0x0,(%rax,%rcx,8)
mov    -0x18(%rbp),%rax
mov    (%rax),%rdi
mov    -0x18(%rbp),%rsi
call   1080 <execv@plt>
mov    $0x2,%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %rsi,%rbx
mov    %edi,%r15d
mov    %rsi,%rdi
call   1070 <TryExecHomeAdbShell@plt>
movslq %r15d,%r12
lea    0x28(,%r12,8),%rdi
call   1060 <malloc@plt>
mov    %rax,%r14
lea    0xe6d(%rip),%rax
mov    %rax,(%r14)
lea    0xe70(%rip),%rax
mov    %rax,0x8(%r14)
xor    %ebp,%ebp
xor    %eax,%eax
call   1050 <InstanceStr@plt>
mov    %rax,0x10(%r14)
lea    0xe5b(%rip),%rax
mov    %rax,0x18(%r14)
lea    0xe56(%rip),%rax
mov    %r12,(%rsp)
cmp    $0x1,%r12d
cmovne %rax,%rbp
mov    %rbp,0x20(%r14)
jle    1229 <main+0xc9>
mov    %r15d,%r13d
add    $0xffffffffffffffff,%r13
xor    %r12d,%r12d
lea    0xe42(%rip),%r15
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
mov    0x8(%rbx,%r12,8),%rdi
call   1030 <strlen@plt>
add    $0x4,%eax
movslq %eax,%rbp
mov    %rbp,%rdi
call   1060 <malloc@plt>
mov    %rax,0x28(%r14,%r12,8)
mov    0x8(%rbx,%r12,8),%rcx
mov    %rax,%rdi
mov    %rbp,%rsi
mov    %r15,%rdx
call   1040 <snprintf@plt>
add    $0x1,%r12
cmp    %r12,%r13
jne    11f0 <main+0x90>
mov    (%rsp),%rax
movq   $0x0,0x20(%r14,%rax,8)
mov    (%r14),%rdi
mov    %r14,%rsi
call   1080 <execv@plt>
mov    $0x2,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [13 x i8] c"/usr/bin/adb\00"
@.str.1 = [3 x i8] c"-s\00"
@.str.2 = [6 x i8] c"shell\00"
@.str.3 = [15 x i8] c"/system/bin/sh\00"
@.str.4 = [5 x i8] c"\22%s\22\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8**
%7 = alloca i32
%8 = alloca i64
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%9 = load i8**, i8*** %5
%10 = call i32 @TryExecHomeAdbShell(i8** %9)
%11 = load i32, i32* %4
%12 = add nsw i32 %11, 5
%13 = sext i32 %12 to i64
%14 = mul i64 %13, 8
%15 = call i8* @malloc(i64 %14)
%16 = bitcast i8* %15 to i8**
store i8** %16, i8*** %6
%17 = load i8**, i8*** %6
%18 = getelementptr inbounds i8*, i8** %17, i64 0
store i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i8** %18
%19 = load i8**, i8*** %6
%20 = getelementptr inbounds i8*, i8** %19, i64 1
store i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8** %20
%21 = call i8* (...) @InstanceStr()
%22 = load i8**, i8*** %6
%23 = getelementptr inbounds i8*, i8** %22, i64 2
store i8* %21, i8** %23
%24 = load i8**, i8*** %6
%25 = getelementptr inbounds i8*, i8** %24, i64 3
store i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i64 0, i64 0), i8** %25
%26 = load i8**, i8*** %6
%27 = getelementptr inbounds i8*, i8** %26, i64 4
store i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.3, i64 0, i64 0), i8** %27
%28 = load i32, i32* %4
%29 = icmp eq i32 %28, 1
br i1 %29, label %30, label %33
30: ; preds = %2
%31 = load i8**, i8*** %6
%32 = getelementptr inbounds i8*, i8** %31, i64 4
store i8* null, i8** %32
br label %33
33: ; preds = %30, %2
store i32 1, i32* %7
br label %34
34: ; preds = %67, %33
%35 = load i32, i32* %7
%36 = load i32, i32* %4
%37 = icmp slt i32 %35, %36
br i1 %37, label %38, label %70
38: ; preds = %34
%39 = load i8**, i8*** %5
%40 = load i32, i32* %7
%41 = sext i32 %40 to i64
%42 = getelementptr inbounds i8*, i8** %39, i64 %41
%43 = load i8*, i8** %42
%44 = call i32 @strlen(i8* %43)
%45 = add nsw i32 %44, 4
%46 = sext i32 %45 to i64
store i64 %46, i64* %8
%47 = load i64, i64* %8
%48 = call i8* @malloc(i64 %47)
%49 = load i8**, i8*** %6
%50 = load i32, i32* %7
%51 = add nsw i32 %50, 4
%52 = sext i32 %51 to i64
%53 = getelementptr inbounds i8*, i8** %49, i64 %52
store i8* %48, i8** %53
%54 = load i8**, i8*** %6
%55 = load i32, i32* %7
%56 = add nsw i32 %55, 4
%57 = sext i32 %56 to i64
%58 = getelementptr inbounds i8*, i8** %54, i64 %57
%59 = load i8*, i8** %58
%60 = load i64, i64* %8
%61 = load i8**, i8*** %5
%62 = load i32, i32* %7
%63 = sext i32 %62 to i64
%64 = getelementptr inbounds i8*, i8** %61, i64 %63
%65 = load i8*, i8** %64
%66 = call i32 @snprintf(i8* %59, i64 %60, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.4, i64 0, i64 0), i8* %65)
br label %67
67: ; preds = %38
%68 = load i32, i32* %7
%69 = add nsw i32 %68, 1
store i32 %69, i32* %7
br label %34
70: ; preds = %34
%71 = load i8**, i8*** %6
%72 = load i32, i32* %4
%73 = add nsw i32 %72, 4
%74 = sext i32 %73 to i64
%75 = getelementptr inbounds i8*, i8** %71, i64 %74
store i8* null, i8** %75
%76 = load i8**, i8*** %6
%77 = getelementptr inbounds i8*, i8** %76, i64 0
%78 = load i8*, i8** %77
%79 = load i8**, i8*** %6
%80 = call i32 @execv(i8* %78, i8** %79)
ret i32 2
}

LLVM IR (-O2):
@.str = [13 x i8] c"/usr/bin/adb\00"
@.str.1 = [3 x i8] c"-s\00"
@.str.2 = [6 x i8] c"shell\00"
@.str.3 = [15 x i8] c"/system/bin/sh\00"
@.str.4 = [5 x i8] c"\22%s\22\00"
define i32 @main(i32 %0, i8** %1) {
%3 = tail call i32 @TryExecHomeAdbShell(i8** %1)
%4 = add nsw i32 %0, 5
%5 = sext i32 %4 to i64
%6 = shl nsw i64 %5, 3
%7 = tail call i8* @malloc(i64 %6)
%8 = bitcast i8* %7 to i8**
store i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str, i64 0, i64 0), i8** %8
%9 = getelementptr inbounds i8*, i8** %8, i64 1
store i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8** %9
%10 = tail call i8* (...) @InstanceStr()
%11 = getelementptr inbounds i8*, i8** %8, i64 2
store i8* %10, i8** %11
%12 = getelementptr inbounds i8*, i8** %8, i64 3
store i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.2, i64 0, i64 0), i8** %12
%13 = getelementptr inbounds i8*, i8** %8, i64 4
%14 = icmp eq i32 %0, 1
%15 = select i1 %14, i8* null, i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.3, i64 0, i64 0)
store i8* %15, i8** %13
%16 = icmp sgt i32 %0, 1
br i1 %16, label %17, label %19
17: ; preds = %2
%18 = zext i32 %0 to i64
br label %25
19: ; preds = %25, %2
%20 = add nsw i32 %0, 4
%21 = sext i32 %20 to i64
%22 = getelementptr inbounds i8*, i8** %8, i64 %21
store i8* null, i8** %22
%23 = load i8*, i8** %8
%24 = tail call i32 @execv(i8* %23, i8** %8)
ret i32 2
25: ; preds = %17, %25
%26 = phi i64 [ 1, %17 ], [ %37, %25 ]
%27 = getelementptr inbounds i8*, i8** %1, i64 %26
%28 = load i8*, i8** %27
%29 = tail call i32 @strlen(i8* %28)
%30 = add nsw i32 %29, 4
%31 = sext i32 %30 to i64
%32 = tail call i8* @malloc(i64 %31)
%33 = add nuw nsw i64 %26, 4
%34 = getelementptr inbounds i8*, i8** %8, i64 %33
store i8* %32, i8** %34
%35 = load i8*, i8** %27
%36 = tail call i32 @snprintf(i8* %32, i64 %31, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.4, i64 0, i64 0), i8* %35)
%37 = add nuw nsw i64 %26, 1
%38 = icmp eq i64 %37, %18
br i1 %38, label %19, label %25
}