Loading page…
Master the fundamental concepts of reverse engineering through this focused micro-challenge.
Three hints are available for this task, revealed one at a time inside the code workspace so you can struggle productively before seeing them.
Every task includes starter code, theory, and hidden tests so you can implement and verify locally in the browser.
How it worksWhen a compiler translates C to assembly, every function follows a predictable pattern at its beginning (prologue) and end (epilogue). Recognizing these patterns is the first skill in manual reverse engineering.
The prologue establishes a stack frame:
cLoading…
The epilogue tears it down:
cLoading…
RBP acts as a stable anchor: locals live at negative offsets ([rbp-0x4]), arguments at positive offsets ([rbp+0x10]). With -fomit-frame-pointer, compilers skip the prologue and use RSP-relative addressing instead.
You will document prologue and epilogue sequences as they appear in objdump output. Ghidra and IDA locate function boundaries by scanning for the push rbp; mov rbp, rsp signature, and GDB's bt command walks the same saved RBP chain.
Search disassembly for push rbp followed by mov rbp, rsp to mark function starts. A ret instruction often marks the end. Between two prologues lies one function body. When -fomit-frame-pointer is enabled, look for sub rsp, N at function entries and add rsp, N before ret instead. Ghidra's auto-analysis uses these heuristics before falling back to slower pattern matching across the entire binary.
Emit the machine code of the standard x86-64 stack frame for a given frame size N:
| Instruction | Bytes |
|---|---|
push rbp | 55 |
mov rbp, rsp | 48 89 e5 |
sub rsp, N, when 0 < N < 128 | 48 83 ec NN (imm8) |
sub rsp, N, when N >= 128 | 48 81 ec and N as 4 bytes little-endian (imm32) |
leave / ret | c9 / c3 |
There is no sub at all when N is 0. The imm8 form is sign-extended, which is why 128 (0x80) already needs imm32. Check your bytes against objdump -d of a compiled function.
T, then T frame sizes in hex.
One line per size, all hex lowercase:
cLoading…