GREM Assembly Language & Debugging Fundamentals 2

Question 1

In x86 assembly, which instruction swaps the values of two registers without using a temporary register?

Accepted Answer

XCHG reg1, reg2

Answer

XCHG atomically exchanges the contents of two registers or a register and memory location without a temporary variable.

Question 2

What does the x86 PUSHAD instruction do?

Accepted Answer

Pushes all general-purpose registers onto the stack in a specific order

Answer

PUSHAD pushes all eight general-purpose registers (EAX, ECX, EDX, EBX, ESP, EBP, ESI, EDI) onto the stack in that order.

Question 3

When analyzing malware in WinDbg, what command displays the current call stack?

Accepted Answer

kv

Answer

The 'kv' command in WinDbg displays the call stack along with frame pointer and return addresses.

Question 4

What is the purpose of the x86 LEA instruction when used as 'LEA EAX, [EBX + ECX*4 + 8]'?

Accepted Answer

Computes the address EBX+ECX*4+8 and stores it in EAX without memory access

Answer

LEA (Load Effective Address) computes the address expression and stores the result in the destination register without performing any memory read.

Question 5

In x86-64 assembly, which calling convention passes the first four integer arguments in RCX, RDX, R8, and R9?

Accepted Answer

Microsoft x64 calling convention

Answer

The Microsoft x64 calling convention uses RCX, RDX, R8, and R9 for the first four integer/pointer arguments.

(GREM) Giac Reverse Engineering Malware Practice Test