GREM Windows Assembly Code Reversing Questions and Answers

Question 1

A reverse engineer is analyzing a malware sample and encounters the following x86 assembly instruction: `LEA EAX, [EBX+ESI*4+0x10]`. What is the primary purpose of this instruction?

Accepted Answer

To calculate the memory address specified by the expression `EBX+ESI*4+0x10` and store this address itself in the EAX register.

Answer

To copy the 4-byte value from the memory address calculated by `EBX+ESI*4+0x10` into the EAX register.

Answer

To add the contents of EBX, ESI (multiplied by 4), and the constant 0x10, storing the result in EAX.

Answer

To shift the bits in the EBX register left by 4 positions, add it to ESI, and store the result in EAX.

Question 2

While reversing a function in a disassembler, an analyst notes the instructions `PUSHAD` at the beginning and `POPAD` at the end. Which of the following is the most likely reason for the malware author to use these instructions?

Accepted Answer

To save the state of all 32-bit general-purpose registers on the stack and restore them later, ensuring the function does not disrupt the caller's context.

Answer

To perform a complex mathematical calculation involving all general-purpose registers.

Answer

To encrypt the function's code by pushing all registers and then popping them in a different order.

Answer

To allocate a large block of memory on the stack for local variables.

Question 3

An analyst is reversing a malware loader and observes a loop that iterates through DLLs in memory, calculates a hash for each exported function name, and compares it to a hardcoded value. If a match is found, it calls the function's address. What is this technique called?

Accepted Answer

API hashing

Answer

Stack string construction

Answer

Run-time dynamic linking

Answer

Return-Oriented Programming (ROP)

Question 4

During assembly code analysis, you encounter the following sequence: `PUSH EBP`, `MOV EBP, ESP`, `SUB ESP, 0x20`. This set of instructions is characteristic of what part of a function?

Accepted Answer

The function prologue

Answer

A conditional jump

Answer

The function epilogue

Answer

An exception handling routine

Question 5

A malware analyst observes the `stdcall` calling convention being used for a series of Windows API calls. In the `stdcall` convention, who is responsible for cleaning up the arguments pushed onto the stack?

Accepted Answer

The callee function

Answer

The operating system kernel

Answer

The caller function

Answer

A garbage collection thread

Question 6

Which of the following x86 instructions performs a bitwise logical AND operation but discards the result, only updating the CPU flags (like the Zero Flag)?

Accepted Answer

TEST

Answer

OR

Answer

CMP

Answer

XOR