A malware function has the prologue `push ebp; mov ebp, esp; sub esp, 10h`. The disassembly shows `mov eax, [ebp+8]` and `mov ecx, [ebp-4]`. What is the relationship between these two memory locations?

Both are local variables, but at different stack depths

Both are arguments, but [ebp-4] is the second argument

[ebp+8] is the first argument, and [ebp-4] is a local variable

[ebp+8] is a local variable, and [ebp-4] is the first argument

A malware function contains a switch statement. The disassembly shows: `mov eax, [ebp+8]; cmp eax, 3; ja default_case; jmp [table+eax*4]`. The jump table has 4 entries. What is the range of case values handled by this switch?

1 through 3, with 3 possible cases plus a default

0 through 3, with 4 possible cases plus a default

0 through 4, with 5 possible cases plus a default

1 through 4, with 4 possible cases plus a default

GIAC Reverse Engineering Malware

Domain 2Objective 2

Reversing Functions in Assembly GREM Practice Questions (Page 5)

Part of the Core Reverse Engineering Concepts domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

Questions 21–25

21foundation · easy
How does the caller retrieve the return value of a function that returns a 64-bit integer on x86?
Select an answer first
22application · medium
A malware function has the prologue `push ebp; mov ebp, esp; sub esp, 10h`. The disassembly shows `mov eax, [ebp+8]` and `mov ecx, [ebp-4]`. What is the relationship between these two memory locations?
Select an answer first
23foundation · easy
In a cdecl function, how is the first argument accessed inside the function after the prologue?
Select an answer first
24expert · hard
A malware function contains a switch statement. The disassembly shows: `mov eax, [ebp+8]; cmp eax, 3; ja default_case; jmp [table+eax*4]`. The jump table has 4 entries. What is the range of case values handled by this switch?
Select an answer first
25foundation · easy
Which calling convention passes the first two arguments in the ECX and EDX registers on x86?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Reversing Functions in Assembly GREM Practice Questions (Page 5)

Questions 21–25

How does the caller retrieve the return value of a function that returns a 64-bit integer on x86?

A malware function has the prologue `push ebp; mov ebp, esp; sub esp, 10h`. The disassembly shows `mov eax, [ebp+8]` and `mov ecx, [ebp-4]`. What is the relationship between these two memory locations?

In a cdecl function, how is the first argument accessed inside the function after the prologue?

A malware function contains a switch statement. The disassembly shows: `mov eax, [ebp+8]; cmp eax, 3; ja default_case; jmp [table+eax*4]`. The jump table has 4 entries. What is the range of case values handled by this switch?

Which calling convention passes the first two arguments in the ECX and EDX registers on x86?

Keep studying — Core Reverse Engineering Concepts