GREM Assembly Language & Debugging Fundamentals 2

Question 1

In x86 assembly, which instruction swaps the values of two registers without using a temporary register?

Accepted Answer

XCHG reg1, reg2

Answer

MOV reg1, reg2

Answer

SWAP reg1, reg2

Answer

PUSH/POP sequence

Question 2

What does the x86 PUSHAD instruction do?

Accepted Answer

Pushes all general-purpose registers onto the stack in a specific order

Answer

Pushes only EAX and EBX onto the stack

Answer

Pushes the EFLAGS register onto the stack

Answer

Pushes the segment registers onto the stack

Question 3

When analyzing malware in WinDbg, what command displays the current call stack?

Accepted Answer

kv

Answer

!stack

Answer

db esp

Answer

lm

Question 4

What is the purpose of the x86 LEA instruction when used as 'LEA EAX, [EBX + ECX*4 + 8]'?

Accepted Answer

Computes the address EBX+ECX*4+8 and stores it in EAX without memory access

Answer

Loads the byte at address EBX+ECX*4+8 into EAX

Answer

Multiplies ECX by 4 and adds it to EBX

Answer

Stores EAX into the memory address computed

Question 5

In x86-64 assembly, which calling convention passes the first four integer arguments in RCX, RDX, R8, and R9?

Accepted Answer

Microsoft x64 calling convention

Answer

System V AMD64 ABI

Answer

cdecl

Answer

stdcall

Question 6

What does a 'rep stosd' instruction do in x86 assembly?

Accepted Answer

Fills memory at ES:EDI with the value in EAX, decrementing ECX each iteration

Answer

Repeats a string search until ECX equals zero

Answer

Copies memory from ESI to EDI ECX times

Answer

Scans memory at EDI for the value in EAX

Question 7

In OllyDbg, what is the purpose of setting a hardware breakpoint rather than a software breakpoint (INT 3)?

Accepted Answer

Hardware breakpoints do not modify code bytes and can detect self-modifying code or packed executables

Answer

Hardware breakpoints are faster to hit

Answer

Hardware breakpoints work on read-only memory

Answer

Hardware breakpoints allow breaking on any instruction count