Reversing Functions in Assembly GREM Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In a stack frame, what is the purpose of the base pointer (EBP) after the prologue?

   • ATo hold the return address of the function
   • BTo store the function's return value
   • CTo serve as a fixed reference point for accessing arguments and local variables
   • DTo point to the top of the stack at all times
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   You are analyzing a 32-bit function that uses the fastcall convention. The function takes three arguments. Which of the following correctly describes how the arguments are passed and accessed inside the function?

   • AAll three arguments are passed in registers, with the third in EAX.
   • BThe first argument is passed in EAX, the second in EDX, and the third on the stack.
   • CThe first two arguments are passed in ECX and EDX, and the third is passed on the stack; inside the function, ECX and EDX are used directly, and the stack argument is accessed via a positive offset from EBP.
   • DAll three arguments are passed on the stack, and the function accesses them via negative offsets from EBP.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   You are analyzing a 32-bit malware binary and notice a function that does NOT start with `push ebp; mov ebp, esp`. Instead, it directly uses `mov eax, [esp+4]` to access its first argument. What is the most likely reason for this?

   • AThe function uses a different calling convention that passes arguments in registers
   • BThe function was hand-written in assembly and skips the standard prologue
   • CThe function is a naked function that does not use the stack
   • DThe function was compiled with frame-pointer omission (FPO) optimization
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   In a 32-bit stdcall function, the prologue is `push ebp; mov ebp, esp`. The function accesses its second argument with `mov eax, [ebp+0Ch]`. How many bytes of arguments does this function expect on the stack?

   • A12 bytes — three arguments, with the second at [ebp+0Ch]
   • B8 bytes — two arguments, with the second at [ebp+0Ch]
   • C4 bytes — only one argument, and [ebp+0Ch] is a local variable
   • D16 bytes — four arguments, with the second at [ebp+0Ch]
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   You are analyzing a 32-bit malware binary that mixes cdecl and stdcall functions. You encounter a call to a function that takes three arguments. After the call, the disassembly shows `add esp, 0Ch`. However, the function's epilogue is `ret 0Ch`. Which of the following is the most plausible explanation for this inconsistency?

   • AThe function is cdecl, and the `ret 0Ch` is a disassembler artifact because the function actually uses a different epilogue.
   • BThe function is actually stdcall, but the caller is also cleaning the stack, which would corrupt the stack unless the function is a variadic function or the disassembly is misleading.
   • CThe function is fastcall, and the stack cleanup is shared between caller and callee.
   • DThe function is a naked function that manually adjusts the stack, so the calling convention is undefined.
   Reveal Solution Discussion Select an answer first