Identify Function Prologues and Epilogues in Assembly

Function Prologues and Epilogues

When a compiler translates C to assembly, every function follows a predictable pattern at its beginning (prologue) and end (epilogue). Recognizing these patterns is the first skill in manual reverse engineering.

Standard x86-64 Patterns

The prologue establishes a stack frame:

cCopy
Loading…

The epilogue tears it down:

cCopy
Loading…

RBP acts as a stable anchor: locals live at negative offsets ([rbp-0x4]), arguments at positive offsets ([rbp+0x10]). With -fomit-frame-pointer, compilers skip the prologue and use RSP-relative addressing instead.

For This Exercise

You will document prologue and epilogue sequences as they appear in objdump output. Ghidra and IDA locate function boundaries by scanning for the push rbp; mov rbp, rsp signature, and GDB's bt command walks the same saved RBP chain.

Spotting Boundaries in Stripped Binaries

Search disassembly for push rbp followed by mov rbp, rsp to mark function starts. A ret instruction often marks the end. Between two prologues lies one function body. When -fomit-frame-pointer is enabled, look for sub rsp, N at function entries and add rsp, N before ret instead. Ghidra's auto-analysis uses these heuristics before falling back to slower pattern matching across the entire binary.