GREM Windows Assembly Code Reversing 2

Question 1

In x86 assembly, what does the instruction 'MOVZX EAX, BYTE PTR [ESI]' accomplish?

Accepted Answer

Zero-extends the byte at address ESI into the full 32-bit EAX register

Answer

MOVZX (Move with Zero-Extension) copies the source byte into the low 8 bits of EAX and fills the upper 24 bits with zeros.

Question 2

Which Windows API function is commonly called by malware to locate the base address of a loaded DLL without importing it explicitly?

Accepted Answer

GetModuleHandleA

Answer

GetModuleHandleA retrieves the base address of a module already loaded in the process without incrementing its reference count, making it useful for stealthy API resolution.

Question 3

When reversing a Windows binary, you see 'PUSH EBP; MOV EBP, ESP' at the start of a function. What is the primary purpose of this prologue?

Accepted Answer

Establishes a new stack frame by saving the caller's base pointer

Answer

The standard function prologue saves EBP so the function can restore it on return, then sets EBP to the current ESP to create a stable frame pointer for accessing arguments and locals.

Question 4

In IDA Pro, what does the 'xref' (cross-reference) feature primarily help a reverse engineer determine?

Accepted Answer

All locations in code that call or reference a given address

Answer

Cross-references show every call site and data reference to a given address, making it easy to trace how a function or string is used across the binary.

Question 5

A malware sample executes 'SUB ESP, 0x20' inside a function body after the standard prologue. What does this instruction accomplish?

Accepted Answer

Decrements the stack pointer to allocate 32 bytes of local stack space

Answer

Subtracting from ESP moves the stack pointer downward (toward lower addresses), reserving space for local variables within the current stack frame.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM Windows Assembly Code Reversing 2