GREM Windows Assembly Code Reversing 3

Question 1

What does the x86 instruction 'LEA EAX, [EBP-8]' store in EAX?

Accepted Answer

The effective address EBP-8, without performing a memory read

Answer

LEA (Load Effective Address) computes the address expression and places the result in the destination register without dereferencing memory.

Question 2

In Windows x64 calling convention (Microsoft ABI), which four registers are used to pass the first four integer/pointer arguments?

Accepted Answer

RCX, RDX, R8, R9

Answer

The Microsoft x64 ABI passes the first four integer or pointer arguments in RCX, RDX, R8, and R9, with additional arguments on the stack.

Question 3

A malware analyst observes repeated use of 'ROL' and 'ROR' instructions on a buffer. What technique does this most likely indicate?

Accepted Answer

A custom or lightweight encryption/obfuscation routine

Answer

Rotate Left (ROL) and Rotate Right (ROR) instructions are frequently used in lightweight ciphers, hash functions, and string obfuscation routines found in malware.

Question 4

When analyzing a Windows PE file in assembly, what does the instruction 'CALL DWORD PTR [EAX+0x3C]' indicate architecturally?

Accepted Answer

An indirect call through a function pointer stored in a structure or vtable at offset 0x3C from EAX

Answer

An indirect CALL through a memory operand like [EAX+0x3C] typically represents a vtable dispatch (C++ virtual call) or a call through a function pointer stored in a struct/object.

Question 5

What is the purpose of the 'REPE SCASB' instruction sequence when used with AL=0 in malware shellcode?

Accepted Answer

Scans EDI forward to find the first zero byte (null terminator), effectively measuring string length

Answer

REPE SCASB with AL=0 repeatedly compares bytes at EDI against zero, advancing EDI until a null byte is found — a common way to compute string length in shellcode.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM Windows Assembly Code Reversing 3