You are analyzing a malware sample that uses opaque predicates and control flow flattening. You have identified a set of opaque predicates that are always true and a dispatcher that uses a state variable. You want to produce a simplified control flow graph. Which combination of techniques is most effective?

Use a debugger to trace the execution and manually draw the control flow graph.

Use a hex editor to patch the opaque predicates to always jump to one branch and then analyze the dispatcher.

Use symbolic execution to solve the opaque predicates and then apply a de-flattening algorithm to the dispatcher.

Use a strings utility to extract all strings and correlate them with the control flow.

Which of the following is a common misdirection technique used by malware to hinder static analysis?

Using standard API calls without obfuscation

Inserting dead code that is never executed

Removing all conditional jumps from the code

Compiling with debug symbols enabled

During static analysis of a suspected trojan, you encounter the following assembly pattern: `xor eax, eax; jz label_true; jmp label_false; label_true: ...`. The `xor eax, eax` always sets the zero flag, so the jump is always taken. You want to simplify the control flow graph to reveal the real logic. Which action is most appropriate?

Delete both jump instructions and assume the code falls through to `label_true`.

Mark the `jz` as a conditional breakpoint in the debugger and continue execution.

Replace the `jz` instruction with an unconditional `jmp` to the always-taken target and remove the unreachable `jmp label_false`.

Change the `xor eax, eax` to `mov eax, 1` so that the zero flag is not set, making the branch go to `label_false`.

You are analyzing a malware sample that uses opaque predicates to hide the true control flow. Some predicates are always true, some are always false, and some depend on runtime conditions. You need to identify which predicates are opaque and which are real. What is the most reliable method?

Assume all predicates are opaque and remove them all.

Use only dynamic tracing to observe the branch outcomes.

Use a combination of static analysis and dynamic tracing to compare the predicted and actual branch outcomes.

Use only static analysis to evaluate the predicates mathematically.

GIAC Reverse Engineering Malware

Domain 3Objective 3

Overcoming Misdirection Techniques GREM Practice Questions (Page 8)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

5concepts

Questions 36–40

36expert · hard
You are analyzing a malware sample that uses opaque predicates and control flow flattening. You have identified a set of opaque predicates that are always true and a dispatcher that uses a state variable. You want to produce a simplified control flow graph. Which combination of techniques is most effective?
Select an answer first
37foundation · easy
Which misdirection technique involves altering the program's control flow so that the disassembler follows a path that is not actually taken at runtime?
Select an answer first
38foundation · easy
Which of the following is a common misdirection technique used by malware to hinder static analysis?
Select an answer first
39application · medium
During static analysis of a suspected trojan, you encounter the following assembly pattern: `xor eax, eax; jz label_true; jmp label_false; label_true: ...`. The `xor eax, eax` always sets the zero flag, so the jump is always taken. You want to simplify the control flow graph to reveal the real logic. Which action is most appropriate?
Select an answer first
40expert · hard
You are analyzing a malware sample that uses opaque predicates to hide the true control flow. Some predicates are always true, some are always false, and some depend on runtime conditions. You need to identify which predicates are opaque and which are real. What is the most reliable method?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Overcoming Misdirection Techniques GREM Practice Questions (Page 8)

Questions 36–40

Which misdirection technique involves altering the program's control flow so that the disassembler follows a path that is not actually taken at runtime?

Which of the following is a common misdirection technique used by malware to hinder static analysis?

You are analyzing a malware sample that uses opaque predicates to hide the true control flow. Some predicates are always true, some are always false, and some depend on runtime conditions. You need to identify which predicates are opaque and which are real. What is the most reliable method?

Keep studying — Malware Patterns and Obfuscation