ASM2 (RE6_ASM_2)

Platform: CUSTOM | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: loop_tracing, manual_memory_simulation, pointer_arithmetic

Summary

Walkthrough of the CUSTOM Reversing ASM2 (RE6_ASM_2). Task: given x86 source asm_2.s, determine the 32-bit value at 0xAABBCCD5 after a descending dword copy loop. Solution: hand-trace the loop (4 iterations, esi/edi decrement by 4) — the target slot inhe

Description

Given x86 source asm_2.s. What 32-bit number will be at 0xAABBCCD5? (Submitted via POST flag on rev-kids20.forkbomb.ru.)

A beginner reverse / static-analysis puzzle: trace a short x86 routine and report the final 32-bit value stored at a specific memory address.

Analysis

The source initializes four consecutive dwords (4 bytes apart), then runs a copy loop:

 asm read-only • copy allowed Copy
mov [0xAABBCCCD], 0xDEADBEEF
mov [0xAABBCCD1], 3405691582
mov [0xAABBCCD5], 0x12345678
mov [0xAABBCCD9], 0x9ABCDEF0
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

lea edi, [0xAABBCCDD]
lea esi, [0xAABBCCD9]
xor ebx, ebx
l1:
mov eax, DWORD [esi]
mov [edi], eax
sub esi, 0x4
sub edi, 0x4
add ebx, 0x4
cmp ebx, 0x10
jl l1

Initial memory (dword-aligned):

Key points:

• esi/edi both decrement by 4 each iteration → the copy walks downward.
• edi (destination) starts at 0xAABBCCDD, esi (source) at 0xAABBCCD9 — destination is always 4 bytes (one dword) above the source.
• ebx counts 0, 4, 8, 0xC and stops once it reaches 0x10, so the loop body runs exactly 0x10 / 4 = 4 times. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This is effectively a descending memmove: every slot receives the value of the slot one dword above it, shifting the array down by one dword.

Solution

Hand-trace the 4 iterations:

Iteration 3 writes CAFEBABE (originally at 0xAABBCCD1) into the target 0xAABBCCD5. No later iteration touches 0xAABBCCD5 again, so that is its final value.

Final value at 0xAABBCCD5 = REDACTED.

Submission note: the checker required the canonical 0x-prefixed hex form, REDACTED. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering loop_tracing, manual_memory_simulation, pointer_arithmetic was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-06-13 • CUSTOM • ASM2 (RE6_ASM_2) • Difficulty: Easy