You are analyzing a packed malware sample. After unpacking, you notice that the code contains many junk instructions and opaque predicates. You need to produce a clean disassembly for further analysis. Which tool or technique is best suited for this task?

Use a debugger to step through the code and write down every instruction that executes.

Use a decompiler that performs symbolic execution and constant folding to remove dead code and simplify predicates.

Use a hex editor to manually remove the junk instructions from the binary.

Use a strings utility to extract printable strings and infer the malware's behavior.

You are analyzing a malware sample that contains many instructions that have no effect on the program state, such as `add eax, 0` and `mov ebx, ebx`. These instructions are used to confuse static analysis. You want to clean up the disassembly. Which technique is most effective?

Use a debugger to step through the code and manually skip the junk instructions.

Use a strings utility to extract all strings and correlate them with the junk instructions.

Use a decompiler that performs constant propagation and dead code elimination.

Use a hex editor to remove the junk instructions from the binary.

While analyzing a suspicious binary in IDA Pro, you notice that many functions contain blocks of instructions that are never reached during dynamic execution. These blocks include meaningless arithmetic operations and conditional jumps that always take the same path. You suspect the malware author inserted these to slow down your static analysis. What is the most effective systematic approach to recover the true logic?

Ignore the unreachable blocks because they do not affect the program's behavior.

Manually patch each unreachable block with NOPs and re-analyze the function.

Use a script or plugin to identify and remove dead code and opaque predicates, then re-run the analysis.

Run the binary in a debugger and set breakpoints on every instruction to trace the actual execution path.

You are analyzing a malware sample that uses control flow flattening. The state variable is updated using a complex hash function, making it difficult to trace manually. You have access to a symbolic execution engine. What is the best way to recover the original control flow?

Patch the hash function to a simple increment to simplify the state transitions.

Use symbolic execution to solve the hash function and enumerate all possible state transitions.

Manually reverse the hash function to determine the state transitions.

Run the malware in a sandbox and record the sequence of basic blocks executed.

A malware sample uses a common misdirection technique: it contains a large number of API calls that are never executed, and the real API calls are obfuscated using a hash-based resolver. You need to identify the actual APIs the malware uses. Which approach is most reliable?

Set breakpoints on the resolver function and log the resolved addresses during dynamic execution.

Run the malware in a sandbox and rely on the API monitor report.

Scan the binary for all imported function names and assume they are all used.

Use a disassembler to follow every call instruction and manually verify each target.

GIAC Reverse Engineering Malware

Domain 3Objective 3

Overcoming Misdirection Techniques GREM Practice Questions (Page 1)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 1–5

1application · medium
You are analyzing a packed malware sample. After unpacking, you notice that the code contains many junk instructions and opaque predicates. You need to produce a clean disassembly for further analysis. Which tool or technique is best suited for this task?
Select an answer first
2application · medium
You are analyzing a malware sample that contains many instructions that have no effect on the program state, such as `add eax, 0` and `mov ebx, ebx`. These instructions are used to confuse static analysis. You want to clean up the disassembly. Which technique is most effective?
Select an answer first
3application · medium
While analyzing a suspicious binary in IDA Pro, you notice that many functions contain blocks of instructions that are never reached during dynamic execution. These blocks include meaningless arithmetic operations and conditional jumps that always take the same path. You suspect the malware author inserted these to slow down your static analysis. What is the most effective systematic approach to recover the true logic?
Select an answer first
4expert · hard
You are analyzing a malware sample that uses control flow flattening. The state variable is updated using a complex hash function, making it difficult to trace manually. You have access to a symbolic execution engine. What is the best way to recover the original control flow?
Select an answer first
5application · medium
A malware sample uses a common misdirection technique: it contains a large number of API calls that are never executed, and the real API calls are obfuscated using a hash-based resolver. You need to identify the actual APIs the malware uses. Which approach is most reliable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.