GREM Windows Assembly Code Reversing 4

Question 1

What distinguishes a 'JMP SHORT' from a 'JMP NEAR' instruction in x86 assembly?

Accepted Answer

JMP SHORT uses an 8-bit signed offset (±127 bytes); JMP NEAR uses a 32-bit signed offset

Answer

JMP SHORT can only jump to addresses below 0x1000; JMP NEAR can jump anywhere

Answer

JMP SHORT switches privilege rings; JMP NEAR stays in the same ring

Answer

JMP SHORT is conditional; JMP NEAR is unconditional

Question 2

A malware sample calls 'NtAllocateVirtualMemory' directly via 'MOV EAX, <syscall_number>; INT 0x2E'. What evasion technique does this represent?

Accepted Answer

Direct system call invocation to bypass user-mode API hooks

Answer

API hashing to resolve function addresses at runtime

Answer

Return-Oriented Programming (ROP) chain execution

Answer

DLL search order hijacking

Question 3

When you encounter 'XOR EAX, EAX' in x86 assembly, what is the most efficient interpretation?

Accepted Answer

Zeroes EAX — a smaller and faster encoding than MOV EAX, 0

Answer

Flips all bits in EAX unconditionally

Answer

Checks if EAX is zero and sets ZF accordingly without modifying EAX

Answer

Performs a bitwise AND of EAX with itself

Question 4

In the context of Windows SEH (Structured Exception Handling), where does an x86 application register an exception handler record?

Accepted Answer

On the thread's stack, linked via FS:[0] pointing to the head of the SEH chain

Answer

In the PE header's Data Directory at index 3

Answer

In the KPCR (Kernel Processor Control Region)

Answer

In a dedicated .seh section in the PE file

Question 5

During code analysis, you find a loop that contains 'INC ECX' and 'CMP ECX, EDX; JB loop_start'. What type of loop control does this implement?

Accepted Answer

An unsigned 'for' loop iterating while ECX is below EDX

Answer

A do-while loop controlled by the Carry Flag

Answer

A signed comparison loop using the Sign and Overflow flags

Answer

A counted repeat using the REP prefix

Question 6

What is the significance of finding the byte sequence 'FF 25' in a disassembly of a Windows PE binary?

Accepted Answer

It is the opcode for JMP DWORD PTR [address], commonly seen in IAT thunks

Answer

It encodes a 'RET 0x25' instruction for stack cleanup

Answer

It represents a software breakpoint followed by a NOP

Answer

It encodes PUSH 0x25 used in system call stubs

Question 7

A reverse engineer notices that a function returns values in both EAX and EDX. What does this typically indicate on Windows x86?

Accepted Answer

The function returns a 64-bit integer, with the low 32 bits in EAX and high 32 bits in EDX

Answer

The function is using the __stdcall convention with two return registers

Answer

The function experienced a divide-by-zero and EDX holds the remainder

Answer

Both registers are being used as output parameters passed by reference