Skip to main content

Loading the code workspace…

LC

Identify Function Prologues and Epilogues in Assembly

medium1/8

PrevDecompile a Simple Program with Ghidra

Language

Compiler

2.0s Limit 256MB

Submit and pass all tests to enable saving to GitHub.

Implementation

Write a C program that documents x86-64 function prologues and epilogues as they would appear in objdump output.

Requirements:

Print a clear explanation of the prologue sequence (push rbp, mov rbp, rsp, sub rsp, N)
Print a clear explanation of the epilogue sequence (leave, ret)
Explain what frame pointers are and why they matter
Describe how to identify function boundaries in raw assembly
Mention compiler optimizations that omit frame pointers
Explain the stack frame linked list used for backtraces
Output must contain the keywords the test cases expect

Success Criteria:

Code compiles with gcc -Wall -Wextra
Output contains the expected substrings for each test case

Why This Matters

Ghidra's and IDA's auto-analysis engines locate function boundaries by scanning for exactly this push-rbp/mov-rbp-rsp signature before falling back to slower heuristics, which is why stripped binaries compiled with -fomit-frame-pointer are noticeably harder for these tools to auto-analyze. GDB's `bt` command reconstructs a stack trace by walking the same chain of saved RBP values you learn to recognize here.

Hints

0 / 3 revealed

Validation Suite

main.c

Workspace 1.0

Decompile a Simple Program with Ghidra →