Reversing Functions in Assembly GREM Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   You are analyzing a function that allocates a local array of 10 integers (40 bytes). The prologue is `sub esp, 28h` (40 bytes). The function accesses the array elements using `[esp+4]` and `[esp+8]` etc., but also uses `[ebp-4]` for a separate local variable. Which of the following is the most likely explanation for the mixed ESP and EBP addressing?

   • AThe compiler used EBP for one local variable but ESP for the array because the array is accessed with a constant offset and the compiler optimized the frame pointer usage.
   • BThe array is actually a global variable, and the `sub esp, 28h` is for something else.
   • CThe function is a naked function that manually manages the stack, so it uses both ESP and EBP arbitrarily.
   • DThe function is using a dynamic stack allocation, so EBP is needed to reference the array.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   You are analyzing a function that has been optimized by the compiler. The prologue is `push ebp; mov ebp, esp; sub esp, 10h`. However, you notice that the function does not use EBP for any memory accesses; instead, it uses ESP-relative addressing for locals. Which of the following is the most likely reason for this mixed usage?

   • AThe compiler used EBP for stack unwinding or exception handling, but optimized the frame pointer omission for local accesses.
   • BThe function is a naked function that manually sets up EBP but uses ESP for locals.
   • CThe disassembler incorrectly labeled the prologue; the function actually uses EBP for arguments.
   • DThe function is using a different calling convention that requires EBP to be set up.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In the cdecl calling convention on x86, who is responsible for cleaning up the stack after a function call?

   • AThe debugger
   • BThe operating system
   • CThe caller
   • DThe callee
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In x86 assembly, which instruction sequence is the standard function prologue that sets up a new stack frame?

   • Apop ebp; ret
   • Bmov esp, ebp; pop ebp
   • Csub esp, N; push ebp
   • Dpush ebp; mov ebp, esp
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How are local variables typically allocated on the stack in an x86 function?

   • ABy pushing each local variable individually
   • BBy adding the total size to the stack pointer (ESP)
   • CBy storing them in registers
   • DBy subtracting the total size from the stack pointer (ESP)
   Reveal Solution Discussion Select an answer first