ARMssembly 0

Description

Solution

1. Step 1Read and understand the assembly
   Open chall.S. The function receives two 32-bit arguments (passed in registers w0 and w1 on AArch64). It compares them with cmp and returns the larger of the two -- a max(a, b) function. With arguments 182476535 and 3742084308, it returns 3742084308.
   cat chall.SCopied!
   Learn more

   AArch64 ARM (64-bit ARM) passes the first four integer arguments in registers x0–x3. The w-prefixed registers (w0, w1) are the lower 32 bits of the corresponding x registers. The assembly uses cmp to set flags, then a conditional branch to pick the larger value and store it in w0 (the return value register).

2. Step 2Convert the result to 8-digit hex
   3742084308 in hexadecimal is 0xdf0bacd4. The flag format requires 8 lowercase hex characters representing the 32-bit result.
   python3 -c "print(hex(3742084308))"Copied!

   # Optionally run with QEMU to verify:Copied!

   aarch64-linux-gnu-gcc -static -o chall chall.SCopied!

   qemu-aarch64-static ./chall 182476535 3742084308Copied!
   Learn more

   QEMU (Quick Emulator) can emulate AArch64 binaries on an x86 host with qemu-aarch64-static. Combined with the aarch64-linux-gnu-gcc cross-compiler, you can assemble and run ARM code without physical ARM hardware. This is the standard approach for ARM CTF challenges on a typical Linux CTF workstation.

   Alternatively, tracing the logic manually: cmp w0, w1 sets flags; a conditional move or branch returns the larger. Since 3742084308 > 182476535, the function returns 3742084308, which is 0xdf0bacd4 in 32-bit hex.

Flag

picoCTF{...}

The assembly compares two 32-bit values and returns the larger -- 3742084308 > 182476535, giving 0xdf0bacd4.