A malware analyst is reviewing a function that appears to have a conditional branch that always takes the same path regardless of input. The disassembly shows `xor eax, eax; test eax, eax; jz loc_always` followed by dead code that never executes. You suspect an opaque predicate. What is the best way to confirm this and proceed with analysis?

Use a decompiler to simplify the expression and see if the branch is always true.

Patch the jump instruction to force the other path and analyze the dead code.

Assume the branch is a normal conditional and analyze both paths in the disassembler.

Use a debugger to step through the branch and observe that the jump is always taken, then mark the dead code as unreachable.

A malware sample registers an exception handler that, when triggered, calls a function pointer stored in a global variable. Static analysis shows the handler is never invoked during normal execution, but the sample still runs correctly. Which technique is the malware most likely using?

Opaque predicate that hides the real call path

Control flow flattening to obscure the main logic

Indirect call via SEH to obfuscate the true control flow

SEH-based anti-debugging that triggers under a debugger

While analyzing a command-and-control client, you find a block of code that uses `mov eax, [ebp+arg_0]` followed by a series of `cmp eax, constant` and `je` instructions. What construct is this most likely implementing?

A switch-case statement with a jump table

A loop with multiple exit conditions

An indirect call through a function pointer

While analyzing a dropper in IDA Pro, you notice a tight loop at 0x401000 that decrements ECX and jumps back to the loop head only when the Zero Flag is clear. The loop exits when ECX reaches zero. Which type of loop structure does this assembly pattern most closely resemble?

A while loop with the condition checked at the top

A do-while loop that executes at least once

An infinite loop with an internal break

A for loop with a post-test condition

GIAC Reverse Engineering Malware

Domain 2Objective 3

Malware Flow Control and Structures GREM Practice Questions (Page 2)

Part of the Core Reverse Engineering Concepts domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

10concepts

Questions 6–10

6expert · hard
A malware analyst is reviewing a function that appears to have a conditional branch that always takes the same path regardless of input. The disassembly shows `xor eax, eax; test eax, eax; jz loc_always` followed by dead code that never executes. You suspect an opaque predicate. What is the best way to confirm this and proceed with analysis?
Select an answer first
7expert · hard
A malware sample registers an exception handler that, when triggered, calls a function pointer stored in a global variable. Static analysis shows the handler is never invoked during normal execution, but the sample still runs correctly. Which technique is the malware most likely using?
Select an answer first
8application · medium
While analyzing a command-and-control client, you find a block of code that uses `mov eax, [ebp+arg_0]` followed by a series of `cmp eax, constant` and `je` instructions. What construct is this most likely implementing?
Select an answer first
9application · medium
In a disassembled function, you see: `mov ecx, 5; loc_401000: ...; dec ecx; jnz loc_401000`. How many times does the loop body execute?
Select an answer first
10application · medium
While analyzing a dropper in IDA Pro, you notice a tight loop at 0x401000 that decrements ECX and jumps back to the loop head only when the Zero Flag is clear. The loop exits when ECX reaches zero. Which type of loop structure does this assembly pattern most closely resemble?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Malware Flow Control and Structures GREM Practice Questions (Page 2)

Questions 6–10

A malware sample registers an exception handler that, when triggered, calls a function pointer stored in a global variable. Static analysis shows the handler is never invoked during normal execution, but the sample still runs correctly. Which technique is the malware most likely using?

While analyzing a command-and-control client, you find a block of code that uses `mov eax, [ebp+arg_0]` followed by a series of `cmp eax, constant` and `je` instructions. What construct is this most likely implementing?

In a disassembled function, you see: `mov ecx, 5; loc_401000: ...; dec ecx; jnz loc_401000`. How many times does the loop body execute?

While analyzing a dropper in IDA Pro, you notice a tight loop at 0x401000 that decrements ECX and jumps back to the loop head only when the Zero Flag is clear. The loop exits when ECX reaches zero. Which type of loop structure does this assembly pattern most closely resemble?

Keep studying — Core Reverse Engineering Concepts