In IDA Pro, you see a function that ends with `pop ebp; retn`. The function was called from two different locations. Which of the following is the most accurate statement about how the disassembler handles these calls and the function's epilogue?

The disassembler identifies the function as a single function with multiple call sites, and the `retn` returns to the address saved by the respective call instruction.

The `retn` instruction returns to a fixed address stored in a global variable.

The disassembler creates two separate functions because there are two call sites.

The `retn` instruction returns to the address stored in EAX.

While analyzing a 32-bit Windows malware sample, you encounter a function that receives three arguments. The disassembly shows the function begins with `push ebp; mov ebp, esp` and ends with `ret 0Ch`. The caller passes arguments by pushing them onto the stack from right to left. Which calling convention is this function using, and who is responsible for cleaning up the stack?

thiscall; the callee cleans up the stack and the first argument is in ECX

cdecl; the caller cleans up the stack after the function returns

stdcall; the callee cleans up the stack before returning

fastcall; the callee cleans up the stack and arguments are passed in ECX and EDX

GIAC Reverse Engineering Malware

Domain 2Objective 2

Reversing Functions in Assembly GREM Practice Questions (Page 1)

Part of the Core Reverse Engineering Concepts domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

Questions 1–5

1foundation · easy
In disassembly, what is the primary indicator that a function is about to return to its caller?
Select an answer first
2application · medium
In IDA Pro, you see a function that ends with `pop ebp; retn`. The function was called from two different locations. Which of the following is the most accurate statement about how the disassembler handles these calls and the function's epilogue?
Select an answer first
3foundation · easy
In x86 assembly, which register is conventionally used to return a 32-bit integer value from a function?
Select an answer first
4application · medium
While analyzing a 32-bit Windows malware sample, you encounter a function that receives three arguments. The disassembly shows the function begins with `push ebp; mov ebp, esp` and ends with `ret 0Ch`. The caller passes arguments by pushing them onto the stack from right to left. Which calling convention is this function using, and who is responsible for cleaning up the stack?
Select an answer first
5foundation · easy
In a typical x86 stack frame, which item is located at the lowest address (closest to the stack pointer) after the prologue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Reversing Functions in Assembly GREM Practice Questions (Page 1)

Questions 1–5

In disassembly, what is the primary indicator that a function is about to return to its caller?

In IDA Pro, you see a function that ends with `pop ebp; retn`. The function was called from two different locations. Which of the following is the most accurate statement about how the disassembler handles these calls and the function's epilogue?

In x86 assembly, which register is conventionally used to return a 32-bit integer value from a function?

In a typical x86 stack frame, which item is located at the lowest address (closest to the stack pointer) after the prologue?

Keep studying — Core Reverse Engineering Concepts