GREM Assembly Language & Debugging Fundamentals 3

Question 1

What is the effect of 'XOR EAX, EAX' in x86 assembly?

Accepted Answer

Sets EAX to zero

Answer

XOR of any value with itself always produces zero; 'XOR EAX, EAX' is the canonical way to zero a register in x86 assembly.

Question 2

In x86 assembly, what does the instruction 'SHR EAX, 2' accomplish?

Accepted Answer

Divides EAX by 4 (unsigned)

Answer

SHR (Shift Right) shifts bits right by the specified count, which is equivalent to unsigned integer division by 2^count, so shifting by 2 divides by 4.

Question 3

When reversing malware, you observe 'CALL EAX' after a series of computations. What technique does this most likely indicate?

Accepted Answer

Dynamic code resolution — the malware computed a function address at runtime to evade static analysis

Answer

Calling a register whose value was computed at runtime is a common anti-static-analysis technique where malware resolves API addresses dynamically to avoid import table inspection.

Question 4

What x86 instruction is used to read from a hardware I/O port, often seen in rootkit and driver-level malware?

Accepted Answer

IN

Answer

The IN instruction reads a byte, word, or dword from a hardware I/O port into AL, AX, or EAX respectively.

Question 5

In a debugger, you observe the sequence: PUSH EBP; MOV EBP, ESP; SUB ESP, 0x40. What is this pattern called?

Accepted Answer

Function prologue

Answer

This three-instruction pattern is the standard x86 function prologue that saves the previous frame pointer and allocates local stack space.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM Assembly Language & Debugging Fundamentals 3