GREM Windows Assembly Code Reversing 4

Question 1

What distinguishes a 'JMP SHORT' from a 'JMP NEAR' instruction in x86 assembly?

Accepted Answer

JMP SHORT uses an 8-bit signed offset (±127 bytes); JMP NEAR uses a 32-bit signed offset

Answer

JMP SHORT encodes a single signed byte as the relative offset, limiting the jump to ±127 bytes from the next instruction; JMP NEAR uses a 32-bit relative offset for longer-range jumps.

Question 2

A malware sample calls 'NtAllocateVirtualMemory' directly via 'MOV EAX, <syscall_number>; INT 0x2E'. What evasion technique does this represent?

Accepted Answer

Direct system call invocation to bypass user-mode API hooks

Answer

Using direct syscall stubs (syscall number in EAX + INT 0x2E or SYSCALL instruction) bypasses user-mode security hooks placed on NTDLL exports by EDR/AV products.

Question 3

When you encounter 'XOR EAX, EAX' in x86 assembly, what is the most efficient interpretation?

Accepted Answer

Zeroes EAX — a smaller and faster encoding than MOV EAX, 0

Answer

XOR EAX, EAX is the idiomatic x86 way to zero a register; it produces a 2-byte encoding versus the 5-byte MOV EAX, 0 and is equally fast on modern CPUs.

Question 4

In the context of Windows SEH (Structured Exception Handling), where does an x86 application register an exception handler record?

Accepted Answer

On the thread's stack, linked via FS:[0] pointing to the head of the SEH chain

Answer

On x86 Windows, FS:[0] points to the top of the SEH chain; each handler record on the stack contains a pointer to the next record and to the handler function.

Question 5

During code analysis, you find a loop that contains 'INC ECX' and 'CMP ECX, EDX; JB loop_start'. What type of loop control does this implement?

Accepted Answer

An unsigned 'for' loop iterating while ECX is below EDX

Answer

JB (Jump if Below) uses the Carry Flag for unsigned comparison, so the loop continues while ECX < EDX in unsigned terms — a typical unsigned for-loop pattern.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM Windows Assembly Code Reversing 4