Malware Flow Control and Structures GREM Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   You are analyzing a function in a 32-bit malware binary. The function begins with `push ebp; mov ebp, esp` and ends with `pop ebp; ret 8`. The caller passes two arguments on the stack. Based on the epilogue, what is the calling convention, and how many bytes of arguments does the callee clean up?

   • Athiscall; the callee cleans up 8 bytes including the `this` pointer.
   • Bfastcall; the first two arguments are passed in ECX and EDX, and the stack cleanup is 8 bytes.
   • Cstdcall; the callee cleans up 8 bytes (two 4-byte arguments).
   • Dcdecl; the caller cleans up 8 bytes after the call.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which assembly pattern is typical of a for loop that iterates a fixed number of times?

   • AExecute body, check condition, jump back if true
   • BIncrement counter, check condition, execute body
   • CCheck condition, execute body, check condition again
   • DInitialize counter, check condition, execute body, increment counter, jump back to condition check
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   In the cdecl calling convention, who is responsible for cleaning up the stack after a function call?

   • AThe debugger
   • BThe callee
   • CThe caller
   • DThe operating system
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which calling convention passes the first two arguments in the ECX and EDX registers on 32-bit x86 systems?

   • Athiscall
   • Bfastcall
   • Cstdcall
   • Dcdecl
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A malware sample registers an exception handler that, when triggered, calls a function that decrypts a second-stage payload. Static analysis shows the handler is registered via a chain of SEH records, but the handler address is only written to the FS:[0] chain at runtime after an anti-debugging check passes. You need to determine the actual handler address for further analysis. Which approach is most reliable?

   • ADisassemble the entire binary and look for the handler address in the .pdata section.
   • BUse a debugger to step over the anti-debugging check and then dump the stack at the current SEH frame.
   • CRead the SEH chain from the static PE header's exception directory.
   • DSet a breakpoint on the instruction that writes to FS:[0] and inspect the value being written.
   Reveal Solution Discussion Select an answer first