Loading page…
Master the fundamental concepts of reverse engineering through this focused micro-challenge.
When a compiler translates C to assembly, every function follows a predictable pattern at its beginning (prologue) and end (epilogue). Recognizing these patterns is the first skill in manual reverse engineering.
The prologue establishes a stack frame:
cLoading…
The epilogue tears it down:
cLoading…
RBP acts as a stable anchor: locals live at negative offsets ([rbp-0x4]), arguments at positive offsets ([rbp+0x10]). With -fomit-frame-pointer, compilers skip the prologue and use RSP-relative addressing instead.
You will document prologue and epilogue sequences as they appear in objdump output. Ghidra and IDA locate function boundaries by scanning for the push rbp; mov rbp, rsp signature, and GDB's bt command walks the same saved RBP chain.
Search disassembly for push rbp followed by mov rbp, rsp to mark function starts. A ret instruction often marks the end. Between two prologues lies one function body. When -fomit-frame-pointer is enabled, look for sub rsp, N at function entries and add rsp, N before ret instead. Ghidra's auto-analysis uses these heuristics before falling back to slower pattern matching across the entire binary.
Write a C program that documents x86-64 function prologues and epilogues as they would appear in objdump output.
Requirements:
Success Criteria:
Three hints are available for this task, revealed one at a time inside the code workspace so you can struggle productively before seeing them.
Every task includes starter code, theory, and hidden tests so you can implement and verify locally in the browser.
How it works