GREM Assembly Language & Debugging Fundamentals 3

Question 1

What is the effect of 'XOR EAX, EAX' in x86 assembly?

Accepted Answer

Sets EAX to zero

Answer

Inverts all bits in EAX

Answer

Compares EAX to itself

Answer

Sets the carry flag

Question 2

In x86 assembly, what does the instruction 'SHR EAX, 2' accomplish?

Accepted Answer

Divides EAX by 4 (unsigned)

Answer

Multiplies EAX by 4

Answer

Rotates EAX right by 2 bits

Answer

Extracts the two most significant bits of EAX

Question 3

When reversing malware, you observe 'CALL EAX' after a series of computations. What technique does this most likely indicate?

Accepted Answer

Dynamic code resolution — the malware computed a function address at runtime to evade static analysis

Answer

A virtual function table dispatch

Answer

A recursive function call

Answer

A return-oriented programming gadget

Question 4

What x86 instruction is used to read from a hardware I/O port, often seen in rootkit and driver-level malware?

Accepted Answer

IN

Answer

MOV

Answer

LD

Answer

READ

Question 5

In a debugger, you observe the sequence: PUSH EBP; MOV EBP, ESP; SUB ESP, 0x40. What is this pattern called?

Accepted Answer

Function prologue

Answer

Stack pivot

Answer

Buffer overflow setup

Answer

Return address overwrite

Question 6

What does the x86 MOVSX instruction do differently from MOV?

Accepted Answer

Sign-extends a smaller source value to fill the larger destination register

Answer

Moves data between memory locations directly

Answer

Moves multiple registers simultaneously

Answer

Swaps source and destination operands

Question 7

In IDA Pro, what does the 'n' key typically do during static analysis?

Accepted Answer

Renames the currently selected item (function, label, or variable)

Answer

Creates a new database

Answer

Navigates to the next cross-reference

Answer

Generates a pseudocode view