ASM0

Platform: rev_kids20 | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-06-13 | Status: Solved Techniques: conditional_jump_analysis, manual_control_flow_tracing

Summary

Task: given an x86 NASM assembly source (asm_0.s), statically trace the control flow and report the final value of edx at the finish label. Solution: hand-trace the jump graph, noting that a cmp of equal operands takes jge (not jl) and only the first satisfied conditional jump fires; edx ends at REDACTED.

ASM0 — rev_kids20

Description

Дан исходный файл на ассемблере (NASM, x86) asm_0.s. Определите значение регистра edx в точке метки finish. edx = ?

English summary: a NASM x86 source file is provided. The goal is to statically trace the control flow and report the value of register edx when execution reaches the finish label. The answer (REDACTED) is submitted via a POST flag form.

Analysis

There is no binary to run — only the assembly source. The challenge is a pure control-flow-tracing exercise over a graph of labels (Metka0..Metka5, finish) connected by conditional and unconditional jumps. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 nasm read-only • copy allowed Copy
_start:
    xor eax, eax        ; eax=ebx=ecx=edx=0
    xor ebx, ebx
    xor ecx, ecx
    xor edx, edx
Metka0:
    add eax, 0x0A
    add ebx, 20
    sub ebx, eax
    cmp eax, ebx
    jl Metka5           ; taken only if eax <  ebx (signed)
    jge Metka4          ; taken if  eax >= ebx
Metka1:
    add ecx, ecx
    add ecx, ecx        ; ecx *= 4
    sub edx, ecx
    cmp edx, eax
    jz finish
    jmp Metka2
...

Two pitfalls make this trickier than it looks:

1. Equal operands. After cmp eax, ebx with eax == ebx, the Zero Flag is set and the Sign/Overflow flags agree, so jl is not taken but jge is.
2. Only the first satisfied jump fires. When two conditional jumps sit back to back (e.g. jl Metka5 / jge Metka4), exactly one of them is taken. The second becomes unreachable for that pass — it is not a fall-through. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Hand-trace from _start:

Step 3 detail (XOR arithmetic):

• edx = 50 = 0x32, ecx = 0x0A
• edx ^= ecx → 0x32 ^ 0x0A = 0x38 = 56
• edx ^= eax → 0x38 ^ 0x0A = 0x32 = 50

At finish, edx = REDACTED. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍