You are analyzing a sophisticated backdoor that uses a combination of opaque predicates and junk instructions. The opaque predicates are based on complex arithmetic expressions that are difficult to evaluate statically. You have a deadline and need to produce a report on the backdoor's capabilities. Which approach best balances accuracy and time?

Manually evaluate each opaque predicate using a calculator.

Run the backdoor in a debugger and step through the predicates one by one.

Use a taint analysis tool to track the data flow from the predicates to the actual behavior.

Ignore the opaque predicates and focus on the API calls in the import table.

A malware sample contains many functions with junk instructions that do not affect the program's state (e.g., `add eax, 0`). These instructions are inserted to confuse static analysis. You want to clean up the code to improve readability. What is the best approach?

Ignore the junk instructions because they do not affect the program's behavior.

Manually remove each junk instruction in a hex editor.

Use a binary analysis framework to automatically detect and remove instructions that have no side effects.

Run the binary in a debugger and skip over the junk instructions.

What is the primary purpose of inserting junk instructions into malware code?

To encrypt the malware's payload

To ensure the malware is compatible with all Windows versions

To increase the size of the binary and slow down analysis

To make the malware run faster on modern CPUs

You are analyzing a malware sample that uses control flow flattening and opaque predicates. You have a tool that can perform symbolic execution, but it is slow and may not finish within your time limit. You also have a debugger. What is the best strategy to maximize the information you can gather?

Skip the analysis and rely on automated sandbox reports.

Use only the debugger to trace the entire binary.

Use symbolic execution on the most critical functions and use the debugger to explore the rest.

Use only symbolic execution on the entire binary.

You are analyzing a packed malware sample. After unpacking, you notice that the code contains many opaque predicates and junk instructions. You want to deobfuscate the code to make it easier to analyze. Which approach is most appropriate?

Manually trace each opaque predicate and patch the binary.

Run the binary in a debugger and set breakpoints on all conditional jumps.

Re-pack the binary to hide the obfuscation.

Use a symbolic execution engine to evaluate predicates and prune unreachable paths.

GIAC Reverse Engineering Malware

Domain 3Objective 3

Overcoming Misdirection Techniques GREM Practice Questions (Page 7)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 31–35

31expert · hard
You are analyzing a sophisticated backdoor that uses a combination of opaque predicates and junk instructions. The opaque predicates are based on complex arithmetic expressions that are difficult to evaluate statically. You have a deadline and need to produce a report on the backdoor's capabilities. Which approach best balances accuracy and time?
Select an answer first
32application · medium
A malware sample contains many functions with junk instructions that do not affect the program's state (e.g., `add eax, 0`). These instructions are inserted to confuse static analysis. You want to clean up the code to improve readability. What is the best approach?
Select an answer first
33foundation · easy
What is the primary purpose of inserting junk instructions into malware code?
Select an answer first
34expert · hard
You are analyzing a malware sample that uses control flow flattening and opaque predicates. You have a tool that can perform symbolic execution, but it is slow and may not finish within your time limit. You also have a debugger. What is the best strategy to maximize the information you can gather?
Select an answer first
35application · medium
You are analyzing a packed malware sample. After unpacking, you notice that the code contains many opaque predicates and junk instructions. You want to deobfuscate the code to make it easier to analyze. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.