You are analyzing a malware sample that uses a technique to hide its true API calls by including many fake API calls in the import table and using a custom resolver. You need to determine which APIs are actually used. Which method is most reliable?

Use a strings utility to extract all API names from the binary and assume they are all used.

Use a debugger to set a breakpoint on the resolver function and log the resolved addresses.

Use a sandbox and rely on the API monitor to list all calls made during execution.

Use a static disassembler to follow all calls to the resolver and assume each call resolves a different API.

You are analyzing a malware sample that uses a combination of dead code and opaque predicates. You have identified the dead code and the predicates, but you need to automate the deobfuscation process for a large binary. Which approach is most scalable?

Write a custom script that uses a disassembler API to identify and patch dead code and opaque predicates.

Use a sandbox to run the malware and rely on the behavioral report.

Manually patch each dead code sequence and opaque predicate in a hex editor.

Use a debugger to trace the entire execution and then manually analyze the trace.

What is control flow flattening?

A way to make all functions have the same signature

A transformation that replaces a program's structured control flow with a state machine and a dispatcher

A method to compress the code to reduce its size

A technique that removes all conditional branches from the code

Which of the following is a systematic approach to deobfuscating malware that uses opaque predicates?

Use a hex editor to change the predicate to always false

Recompile the malware with optimization flags

Run the malware in a debugger and set breakpoints on the predicate to observe its actual value

Search for all conditional jumps and remove them from the binary

You are analyzing a botnet client that uses control flow flattening. The binary has a large dispatcher that uses a state variable to jump between basic blocks. You want to understand the command-and-control logic. What is the most effective way to reconstruct the original control flow?

Run the binary in a sandbox and observe the network traffic.

Manually trace the state variable through all possible values.

Use a decompiler that supports control flow flattening recovery.

Patch the dispatcher to always jump to the first block.

GIAC Reverse Engineering Malware

Domain 3Objective 3

Overcoming Misdirection Techniques GREM Practice Questions (Page 6)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 26–30

26application · medium
You are analyzing a malware sample that uses a technique to hide its true API calls by including many fake API calls in the import table and using a custom resolver. You need to determine which APIs are actually used. Which method is most reliable?
Select an answer first
27application · hard
You are analyzing a malware sample that uses a combination of dead code and opaque predicates. You have identified the dead code and the predicates, but you need to automate the deobfuscation process for a large binary. Which approach is most scalable?
Select an answer first
28foundation · easy
What is control flow flattening?
Select an answer first
29foundation · easy
Which of the following is a systematic approach to deobfuscating malware that uses opaque predicates?
Select an answer first
30application · medium
You are analyzing a botnet client that uses control flow flattening. The binary has a large dispatcher that uses a state variable to jump between basic blocks. You want to understand the command-and-control logic. What is the most effective way to reconstruct the original control flow?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.