ASM3 (RE6_ASM_3)

Platform: rev_kids20 | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-06-13 | Status: Solved Techniques: manual_emulation, mul_semantics, register_trace

Summary

Task: x86 NASM source asm_3.s is given and you must report the final value of register ecx. Solution: manually trace the instruction stream, applying mul semantics (EDX:EAX = EAXoperand, low 32 bits in EAX) and tracking ebx as a saved copy of the input, yielding 10^3 + 107 + 37 = REDACTED.

ASM3 (RE6_ASM_3) — rev_kids20

Description

Given x86 NASM source asm_3.s. Answer: ecx = ?

A short beginner-level x86 (32-bit) reversing task from the Timofey/Reverse track. The challenge gives raw NASM assembly and asks for the value of register ecx after the final instruction executes. The answer is submitted via a POST flag request to rev-kids20.forkbomb.ru.

Analysis

Source asm_3.s:

 asm read-only • copy allowed Copy
BITS 32
global _start
section .text
_start:
mov eax, 10
mov ebx, eax     ; ebx = 10 (preserved copy of the original input)
mul eax          ; EDX:EAX = EAX * EAX
mov esi, 10
mul esi          ; EDX:EAX = EAX * ESI
mov ecx, eax
mov eax, ebx     ; restore the original 10 from the saved copy
mov esi, 7
mul esi          ; EDX:EAX = EAX * ESI
add ecx, eax
add ecx, 37

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Two facts drive the whole trace:

1. mul r/m32 semantics — the implicit operand is EAX. The full 64-bit product is stored as EDX:EAX; the low 32 bits land in EAX, the high 32 bits in EDX. Here every product fits in 32 bits, so EDX (the high word) can be ignored entirely.
2. ebx is a preserved copy of the original input value 10. It is never clobbered by the multiply chain, so it can be restored into eax later to start a second, independent computation.

Solution

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step-by-step register trace:

1. mov eax, 10 → eax = 10
2. mov ebx, eax → ebx = 10 (saved copy)
3. mul eax → eax = 10 * 10 = 100
4. mov esi, 10 → esi = 10
5. mul esi → eax = 100 * 10 = 1000
6. mov ecx, eax → ecx = 1000
7. mov eax, ebx → eax = 10 (restored from saved copy)
8. mov esi, 7 → esi = 7
9. mul esi → eax = 10 * 7 = 70
10. add ecx, eax → ecx = 1000 + 70 = 1070
11. add ecx, 37 → ecx = 1070 + 37 = REDACTED

The program computes:

ecx = 10^3 + 10*7 + 37 = REDACTED

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Final ecx = REDACTED.

 python read-only • copy allowed Copy
#!/usr/bin/env python3
# Manual emulation of asm_3.s
eax = 10
ebx = eax            # mov ebx, eax  (saved copy)
eax = (eax * eax) & 0xFFFFFFFF   # mul eax  -> 100
esi = 10
eax = (eax * esi) & 0xFFFFFFFF   # mul esi  -> 1000
ecx = eax                        # ecx = 1000
eax = ebx                        # restore 10
esi = 7
eax = (eax * esi) & 0xFFFFFFFF   # mul esi  -> 70
ecx = (ecx + eax) & 0xFFFFFFFF   # 1070
ecx = (ecx + 37) & 0xFFFFFFFF    # REDACTED
print(ecx)   # REDACTED

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Submit the answer:

 bash read-only • copy allowed Copy
curl -s -X POST -d 'flag=REDACTED' http://rev-kids20.forkbomb.ru/...

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍