In a disassembled malware function, you see the following sequence: `cmp eax, 5; ja default_case; jmp dword ptr [eax*4 + jump_table]`. The jump table contains 6 entries. What does this construct represent, and what is the purpose of the `cmp eax, 5` instruction?

A function pointer array used for indirect calls, with 6 possible functions.

A switch-case with 6 cases (0–5) and a default; the `cmp` ensures EAX is within the table bounds.

A conditional branch that checks if EAX is equal to 5.

A loop that iterates 6 times, with EAX as the loop counter.

In a 32-bit malware binary, you see the following bytes at the start of a function: `55 8B EC 83 EC 10`. What is the function prologue doing?

Saving the base pointer and allocating 16 bytes of local storage

Allocating 16 bytes and saving the instruction pointer

Setting up a frame pointer and pushing three registers

Saving the stack pointer and jumping to a new location

When tracing the control flow of a function in a disassembler, which sequence of instructions would you expect to see at the end of a basic block that ends with an unconditional transfer of control?

A JMP instruction to another address

In a malware sample, you see the instruction `call dword ptr [esi+0x1C]` where ESI points to a structure that is initialized at runtime. You need to determine which function is being called. What is the most effective approach?

Set a breakpoint on the call instruction and inspect the value at [ESI+0x1C] at runtime.

Search the binary for all functions that match the calling convention and guess.

Use the disassembler's cross-reference feature to find all references to ESI.

Patch the instruction to call a known function and compare behavior.

In a Windows executable, what data structure is used to maintain a linked list of exception handlers that the CPU consults when an exception occurs?

The Process Environment Block (PEB)

The Thread Environment Block (TEB)

The Structured Exception Handling (SEH) chain

GIAC Reverse Engineering Malware

Domain 2Objective 3

Malware Flow Control and Structures GREM Practice Questions (Page 8)

Part of the Core Reverse Engineering Concepts domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

10concepts

Questions 36–40

36application · medium
In a disassembled malware function, you see the following sequence: `cmp eax, 5; ja default_case; jmp dword ptr [eax*4 + jump_table]`. The jump table contains 6 entries. What does this construct represent, and what is the purpose of the `cmp eax, 5` instruction?
Select an answer first
37application · medium
In a 32-bit malware binary, you see the following bytes at the start of a function: `55 8B EC 83 EC 10`. What is the function prologue doing?
Select an answer first
38foundation · easy
When tracing the control flow of a function in a disassembler, which sequence of instructions would you expect to see at the end of a basic block that ends with an unconditional transfer of control?
Select an answer first
39application · medium
In a malware sample, you see the instruction `call dword ptr [esi+0x1C]` where ESI points to a structure that is initialized at runtime. You need to determine which function is being called. What is the most effective approach?
Select an answer first
40foundation · easy
In a Windows executable, what data structure is used to maintain a linked list of exception handlers that the CPU consults when an exception occurs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.