How do you recognize a function prologue and epilogue in assembly?

The prologue saves callee-saved registers (push) and allocates locals (sub $N, %rsp); the epilogue reverses both before ret.

* Prologue pushes callee-saved registers and subtracts %rsp for locals; the epilogue exactly reverses both (add %rsp, pop in reverse) before ret. leave replaces the two-step teardown when a frame pointer is used. *

Typical prologue:

my_func:
    push %rbp
    push %rbx
    sub  $0x18, %rsp

Typical epilogue:

    add  $0x18, %rsp
    pop  %rbx
    pop  %rbp
    ret

What each part does:

• push %rbp / push %rbx — save callee-saved registers the function will use
• sub $0x18, %rsp — allocate 24 bytes for local variables
• Epilogue reverses everything in opposite order

Minimal function (uses no callee-saved registers, no locals):

my_func:
    # just does work with caller-saved registers
    ret

With frame pointer (when compiled with -fno-omit-frame-pointer):

    push %rbp
    mov  %rsp, %rbp
    ...
    leave
    ret

leave = mov %rbp, %rsp + pop %rbp

Go deeper:

• Function prologue and epilogue (Wikipedia) — Defines both directly: prologue prepares the stack/registers, epilogue restores them.
• Stack frame layout on x86-64 (Eli Bendersky) — Shows real prologue/epilogue code, the red zone, and frame-pointer omission on x86-64.