GREM Windows Assembly Code Reversing Questions and Answers

Question 1

A reverse engineer is analyzing a malware sample and encounters the following x86 assembly instruction: `LEA EAX, [EBX+ESI*4+0x10]`. What is the primary purpose of this instruction?

Accepted Answer

To calculate the memory address specified by the expression `EBX+ESI*4+0x10` and store this address itself in the EAX register.

Answer

The LEA (Load Effective Address) instruction calculates the address specified by the source operand (the part in brackets) and loads that address into the destination register. It does not access the memory at that address. In this case, it calculates the address by adding the value in EBX, the value in ESI scaled by 4, and the constant offset 0x10, and then places the resulting address into EAX. This is often used for pointer arithmetic or complex calculations.

Question 2

While reversing a function in a disassembler, an analyst notes the instructions `PUSHAD` at the beginning and `POPAD` at the end. Which of the following is the most likely reason for the malware author to use these instructions?

Accepted Answer

To save the state of all 32-bit general-purpose registers on the stack and restore them later, ensuring the function does not disrupt the caller's context.

Answer

The `PUSHAD` instruction pushes all 32-bit general-purpose registers (EAX, ECX, EDX, EBX, ESP, EBP, ESI, EDI) onto the stack. The corresponding `POPAD` instruction pops them back off in the reverse order. This is a common technique, especially in shellcode or injected code, to preserve the state of the processor so that the calling program can continue its execution without errors after the malicious function completes.

Question 3

An analyst is reversing a malware loader and observes a loop that iterates through DLLs in memory, calculates a hash for each exported function name, and compares it to a hardcoded value. If a match is found, it calls the function's address. What is this technique called?

Accepted Answer

API hashing

Answer

API hashing is a common obfuscation technique where malware avoids storing the names of Windows API functions (like `CreateProcessA` or `VirtualAlloc`) directly in its import table. Instead, it computes a hash of the required function names and stores these hashes. At runtime, it dynamically finds the addresses of these functions by hashing the names of exported functions from loaded libraries (like kernel32.dll) and comparing them to the stored hashes. This makes static analysis more difficult.

Question 4

During assembly code analysis, you encounter the following sequence: `PUSH EBP`, `MOV EBP, ESP`, `SUB ESP, 0x20`. This set of instructions is characteristic of what part of a function?

Accepted Answer

The function prologue

Answer

This sequence is a standard function prologue in x86 assembly. `PUSH EBP` saves the caller's base pointer. `MOV EBP, ESP` establishes the new stack frame pointer for the current function. `SUB ESP, 0x20` allocates 0x20 bytes of space on the stack for local variables. This setup allows the function to have its own area on the stack to work with.

Question 5

A malware analyst observes the `stdcall` calling convention being used for a series of Windows API calls. In the `stdcall` convention, who is responsible for cleaning up the arguments pushed onto the stack?

Accepted Answer

The callee function

Answer

In the `stdcall` (standard call) calling convention, which is used by most Win32 API functions, the callee (the function that was called) is responsible for cleaning up the stack. This is typically done with a `RET n` instruction, where `n` is the number of bytes of arguments to remove from the stack. This contrasts with the `cdecl` convention, where the caller cleans the stack.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM Windows Assembly Code Reversing Questions and Answers