#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int /*<<< orphan*/ atoi(char *);
int checkAgainstWhitelist(char *);
int /*<<< orphan*/ fclose(int /*<<< orphan*/ *);
scalar_t__ fgets(char *, int, int /*<<< orphan*/ *);
int /*<<< orphan*/ *fopen(char *, char *);
char *getProcName(int /*<<< orphan*/);
scalar_t__ isspace(char);
int /*<<< orphan*/ printf(char *, char *);
int /*<<< orphan*/ snprintf(char *, int, char const *, ...);
int /*<<< orphan*/ strace(int /*<<< orphan*/, char *);
scalar_t__ strncmp(char *, char *, int);
void monitorProcessForkIfExist() {
  const char resultPath[] = "/data/local/tmp/strace.txt";
  char path[40], line[100], *p;
  FILE *stracef;
  snprintf(path, 40, resultPath);
  stracef = fopen(path, "r");
  if (!stracef)
    return;
  while (fgets(line, 100, stracef)) {
    if (strncmp(line, "fork()", 6) != 0)
      continue;
    p = line + 6;
    while (isspace(*p))
      ++p;
    ++p;
    ++p;
    printf("found process. PID %s\n", p);
    int isWhitelisted = checkAgainstWhitelist(p);
    if (!isWhitelisted) {
      char straceProcessResult[100];
      char *procName = getProcName(atoi(p));
      snprintf(straceProcessResult, 100, "/data/local/tmp/strace_%s", procName);
      strace(atoi(p), straceProcessResult);
    }
  }
  fclose(stracef);
}


x86 assembly (clang, -O0):
<monitorProcessForkIfExist>:
push   %rbp
mov    %rsp,%rbp
sub    $0x150,%rsp
mov    0xe3e(%rip),%rax
mov    %rax,-0x20(%rbp)
mov    0xe3b(%rip),%rax
mov    %rax,-0x18(%rbp)
mov    0xe38(%rip),%rax
mov    %rax,-0x10(%rbp)
mov    0xe35(%rip),%ax
mov    %ax,-0x8(%rbp)
mov    0xe2d(%rip),%al
mov    %al,-0x6(%rbp)
lea    -0x50(%rbp),%rdi
lea    -0x20(%rbp),%rdx
mov    $0x28,%esi
mov    $0x0,%al
call   1070 <snprintf@plt>
lea    -0x50(%rbp),%rdi
lea    0xe0c(%rip),%rsi
call   10c0 <fopen@plt>
mov    %rax,-0xd0(%rbp)
cmpq   $0x0,-0xd0(%rbp)
jne    122e <monitorProcessForkIfExist+0x7e>
jmp    137a <monitorProcessForkIfExist+0x1ca>
jmp    1233 <monitorProcessForkIfExist+0x83>
lea    -0xc0(%rbp),%rdi
mov    -0xd0(%rbp),%rdx
mov    $0x64,%esi
call   10a0 <fgets@plt>
cmp    $0x0,%rax
je     136e <monitorProcessForkIfExist+0x1be>
lea    -0xc0(%rbp),%rdi
lea    0xdba(%rip),%rsi
mov    $0x6,%edx
call   1030 <strncmp@plt>
cmp    $0x0,%rax
je     127c <monitorProcessForkIfExist+0xcc>
jmp    1233 <monitorProcessForkIfExist+0x83>
lea    -0xc0(%rbp),%rax
add    $0x6,%rax
mov    %rax,-0xc8(%rbp)
mov    -0xc8(%rbp),%rax
movsbl (%rax),%edi
call   1090 <isspace@plt>
cmp    $0x0,%rax
je     12be <monitorProcessForkIfExist+0x10e>
mov    -0xc8(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0xc8(%rbp)
jmp    128e <monitorProcessForkIfExist+0xde>
mov    -0xc8(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0xc8(%rbp)
mov    -0xc8(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0xc8(%rbp)
mov    -0xc8(%rbp),%rsi
lea    0xd34(%rip),%rdi
call   1060 <printf@plt>
mov    -0xc8(%rbp),%rdi
call   10b0 <checkAgainstWhitelist@plt>
mov    %eax,-0xd4(%rbp)
cmpl   $0x0,-0xd4(%rbp)
jne    1369 <monitorProcessForkIfExist+0x1b9>
mov    -0xc8(%rbp),%rdi
call   10d0 <atoi@plt>
mov    %eax,%edi
call   1040 <getProcName@plt>
mov    %rax,-0x148(%rbp)
lea    -0x140(%rbp),%rdi
mov    -0x148(%rbp),%rcx
mov    $0x64,%esi
lea    0xcf3(%rip),%rdx
mov    $0x0,%al
call   1070 <snprintf@plt>
mov    -0xc8(%rbp),%rdi
call   10d0 <atoi@plt>
mov    %eax,%edi
lea    -0x140(%rbp),%rsi
call   1080 <strace@plt>
jmp    1233 <monitorProcessForkIfExist+0x83>
mov    -0xd0(%rbp),%rdi
call   1050 <fclose@plt>
add    $0x150,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<monitorProcessForkIfExist>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x128,%rsp
movups 0xe43(%rip),%xmm0
movups %xmm0,0xb(%rsp)
movaps 0xe2c(%rip),%xmm0
movaps %xmm0,(%rsp)
lea    0x90(%rsp),%rbx
mov    %rsp,%rdx
mov    %rbx,%rdi
mov    $0x28,%esi
xor    %eax,%eax
call   1070 <snprintf@plt>
lea    0xe22(%rip),%rsi
mov    %rbx,%rdi
call   10c0 <fopen@plt>
test   %rax,%rax
je     1310 <monitorProcessForkIfExist+0x160>
mov    %rax,%rbx
lea    0x20(%rsp),%rdi
mov    $0x64,%esi
mov    %rax,%rdx
call   10a0 <fgets@plt>
test   %rax,%rax
je     1308 <monitorProcessForkIfExist+0x158>
lea    0x27(%rsp),%r12
lea    0xde9(%rip),%rbp
lea    0x20(%rsp),%r15
lea    0xde4(%rip),%r14
jmp    1269 <monitorProcessForkIfExist+0xb9>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax)
mov    %r15,%rdi
mov    $0x64,%esi
mov    %rbx,%rdx
call   10a0 <fgets@plt>
test   %rax,%rax
je     1308 <monitorProcessForkIfExist+0x158>
mov    %r15,%rdi
mov    %rbp,%rsi
mov    $0x6,%edx
call   1030 <strncmp@plt>
test   %rax,%rax
jne    1250 <monitorProcessForkIfExist+0xa0>
mov    %r12,%r13
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
movsbl -0x1(%r13),%edi
call   1090 <isspace@plt>
add    $0x1,%r13
test   %rax,%rax
jne    1290 <monitorProcessForkIfExist+0xe0>
mov    %r14,%rdi
mov    %r13,%rsi
call   1060 <printf@plt>
mov    %r13,%rdi
call   10b0 <checkAgainstWhitelist@plt>
test   %eax,%eax
jne    1250 <monitorProcessForkIfExist+0xa0>
mov    %r13,%rdi
call   10d0 <atoi@plt>
mov    %eax,%edi
call   1040 <getProcName@plt>
lea    0xc0(%rsp),%rbp
mov    %rbp,%rdi
mov    $0x64,%esi
lea    0xd5b(%rip),%rdx
mov    %rax,%rcx
xor    %eax,%eax
call   1070 <snprintf@plt>
mov    %r13,%rdi
call   10d0 <atoi@plt>
mov    %eax,%edi
mov    %rbp,%rsi
lea    0xd1f(%rip),%rbp
call   1080 <strace@plt>
jmp    1250 <monitorProcessForkIfExist+0xa0>
mov    %rbx,%rdi
call   1050 <fclose@plt>
add    $0x128,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@__const.monitorProcessForkIfExist.resultPath = [27 x i8] c"/data/local/tmp/strace.txt\00"
@.str = [2 x i8] c"r\00"
@.str.1 = [7 x i8] c"fork()\00"
@.str.2 = [23 x i8] c"found process. PID %s\0A\00"
@.str.3 = [26 x i8] c"/data/local/tmp/strace_%s\00"
define void @monitorProcessForkIfExist() {
%1 = alloca [27 x i8]
%2 = alloca [40 x i8]
%3 = alloca [100 x i8]
%4 = alloca i8*
%5 = alloca i32*
%6 = alloca i32
%7 = alloca [100 x i8]
%8 = alloca i8*
%9 = bitcast [27 x i8]* %1 to i8*
%10 = getelementptr inbounds [40 x i8], [40 x i8]* %2, i64 0, i64 0
%11 = getelementptr inbounds [27 x i8], [27 x i8]* %1, i64 0, i64 0
%12 = call i32 (i8*, i32, i8*, ...) @snprintf(i8* %10, i32 40, i8* %11)
%13 = getelementptr inbounds [40 x i8], [40 x i8]* %2, i64 0, i64 0
%14 = call i32* @fopen(i8* %13, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
store i32* %14, i32** %5
%15 = load i32*, i32** %5
%16 = icmp ne i32* %15, null
br i1 %16, label %18, label %17
17: ; preds = %0
br label %66
18: ; preds = %0
br label %19
19: ; preds = %62, %28, %18
%20 = getelementptr inbounds [100 x i8], [100 x i8]* %3, i64 0, i64 0
%21 = load i32*, i32** %5
%22 = call i64 @fgets(i8* %20, i32 100, i32* %21)
%23 = icmp ne i64 %22, 0
br i1 %23, label %24, label %63
24: ; preds = %19
%25 = getelementptr inbounds [100 x i8], [100 x i8]* %3, i64 0, i64 0
%26 = call i64 @strncmp(i8* %25, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.1, i64 0, i64 0), i32 6)
%27 = icmp ne i64 %26, 0
br i1 %27, label %28, label %29
28: ; preds = %24
br label %19
29: ; preds = %24
%30 = getelementptr inbounds [100 x i8], [100 x i8]* %3, i64 0, i64 0
%31 = getelementptr inbounds i8, i8* %30, i64 6
store i8* %31, i8** %4
br label %32
32: ; preds = %37, %29
%33 = load i8*, i8** %4
%34 = load i8, i8* %33
%35 = call i64 @isspace(i8 signext %34)
%36 = icmp ne i64 %35, 0
br i1 %36, label %37, label %40
37: ; preds = %32
%38 = load i8*, i8** %4
%39 = getelementptr inbounds i8, i8* %38, i32 1
store i8* %39, i8** %4
br label %32
40: ; preds = %32
%41 = load i8*, i8** %4
%42 = getelementptr inbounds i8, i8* %41, i32 1
store i8* %42, i8** %4
%43 = load i8*, i8** %4
%44 = getelementptr inbounds i8, i8* %43, i32 1
store i8* %44, i8** %4
%45 = load i8*, i8** %4
%46 = call i32 @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.2, i64 0, i64 0), i8* %45)
%47 = load i8*, i8** %4
%48 = call i32 @checkAgainstWhitelist(i8* %47)
store i32 %48, i32* %6
%49 = load i32, i32* %6
%50 = icmp ne i32 %49, 0
br i1 %50, label %62, label %51
51: ; preds = %40
%52 = load i8*, i8** %4
%53 = call i32 @atoi(i8* %52)
%54 = call i8* @getProcName(i32 %53)
store i8* %54, i8** %8
%55 = getelementptr inbounds [100 x i8], [100 x i8]* %7, i64 0, i64 0
%56 = load i8*, i8** %8
%57 = call i32 (i8*, i32, i8*, ...) @snprintf(i8* %55, i32 100, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.3, i64 0, i64 0), i8* %56)
%58 = load i8*, i8** %4
%59 = call i32 @atoi(i8* %58)
%60 = getelementptr inbounds [100 x i8], [100 x i8]* %7, i64 0, i64 0
%61 = call i32 @strace(i32 %59, i8* %60)
br label %62
62: ; preds = %51, %40
br label %19
63: ; preds = %19
%64 = load i32*, i32** %5
%65 = call i32 @fclose(i32* %64)
br label %66
66: ; preds = %63, %17
ret void
}

LLVM IR (-O2):
@__const.monitorProcessForkIfExist.resultPath = [27 x i8] c"/data/local/tmp/strace.txt\00"
@.str = [2 x i8] c"r\00"
@.str.1 = [7 x i8] c"fork()\00"
@.str.2 = [23 x i8] c"found process. PID %s\0A\00"
@.str.3 = [26 x i8] c"/data/local/tmp/strace_%s\00"
define void @monitorProcessForkIfExist() {
%1 = alloca [27 x i8]
%2 = alloca [40 x i8]
%3 = alloca [100 x i8]
%4 = alloca [100 x i8]
%5 = getelementptr inbounds [27 x i8], [27 x i8]* %1, i64 0, i64 0
%6 = getelementptr inbounds [40 x i8], [40 x i8]* %2, i64 0, i64 0
%7 = getelementptr inbounds [100 x i8], [100 x i8]* %3, i64 0, i64 0
%8 = call i32 (i8*, i32, i8*, ...) @snprintf(i8* %6, i32 40, i8* %5)
%9 = call i32* @fopen(i8* %6, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str, i64 0, i64 0))
%10 = icmp eq i32* %9, null
br i1 %10, label %42, label %11
11: ; preds = %0
%12 = call i64 @fgets(i8* %7, i32 100, i32* %9)
%13 = icmp eq i64 %12, 0
br i1 %13, label %40, label %14
14: ; preds = %11
%15 = getelementptr inbounds [100 x i8], [100 x i8]* %3, i64 0, i64 6
%16 = getelementptr inbounds [100 x i8], [100 x i8]* %4, i64 0, i64 0
br label %17
17: ; preds = %14, %37
%18 = call i64 @strncmp(i8* %7, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @.str.1, i64 0, i64 0), i32 6)
%19 = icmp eq i64 %18, 0
br i1 %19, label %20, label %37
20: ; preds = %17, %20
%21 = phi i8* [ %25, %20 ], [ %15, %17 ]
%22 = load i8, i8* %21
%23 = call i64 @isspace(i8 signext %22)
%24 = icmp eq i64 %23, 0
%25 = getelementptr inbounds i8, i8* %21, i64 1
br i1 %24, label %26, label %20
26: ; preds = %20
%27 = getelementptr inbounds i8, i8* %21, i64 2
%28 = call i32 @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.2, i64 0, i64 0), i8* %27)
%29 = call i32 @checkAgainstWhitelist(i8* %27)
%30 = icmp eq i32 %29, 0
br i1 %30, label %31, label %37
31: ; preds = %26
%32 = call i32 @atoi(i8* %27)
%33 = call i8* @getProcName(i32 %32)
%34 = call i32 (i8*, i32, i8*, ...) @snprintf(i8* %16, i32 100, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.3, i64 0, i64 0), i8* %33)
%35 = call i32 @atoi(i8* %27)
%36 = call i32 @strace(i32 %35, i8* %16)
br label %37
37: ; preds = %26, %31, %17
%38 = call i64 @fgets(i8* %7, i32 100, i32* %9)
%39 = icmp eq i64 %38, 0
br i1 %39, label %40, label %17
40: ; preds = %37, %11
%41 = call i32 @fclose(i32* %9)
br label %42
42: ; preds = %0, %40
ret void
}