A 32-bit malware function uses the fastcall convention. The disassembly shows the function accesses `[esp+4]` to read a value. What does this stack location contain?

The first function argument, because fastcall passes all arguments on the stack

The return address of the function

A local variable that was pushed onto the stack by the prologue

The third function argument, because the first two are in ECX and EDX

A malware function allocates several local variables. The prologue is `push ebp; mov ebp, esp; sub esp, 20h`. Later, the code writes to `[ebp-4]`, `[ebp-8]`, and `[ebp-0Ch]`. What is the most accurate interpretation of these memory accesses?

They are the return address and saved EBP.

They are local variables allocated in the 32-byte region reserved by `sub esp, 20h`.

They are function arguments passed by the caller.

They are saved registers from the caller's context.

You are reversing a 32-bit function that begins with `push ebp; mov ebp, esp; sub esp, 10h`. Inside the function, you see an instruction `mov [ebp-8], eax`. What does `[ebp-8]` most likely represent?

The saved base pointer from the caller, which is at the top of the stack frame

A local variable, because the `sub esp, 10h` allocated 16 bytes of stack space for locals

The saved return address, which is always placed at [ebp-4]

The first function argument, which is stored at a negative offset from the base pointer

GIAC Reverse Engineering Malware

Domain 2Objective 2

Reversing Functions in Assembly GREM Practice Questions (Page 6)

Part of the Core Reverse Engineering Concepts domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 4–6 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

Questions 26–30

26application · medium
A 32-bit malware function uses the fastcall convention. The disassembly shows the function accesses `[esp+4]` to read a value. What does this stack location contain?
Select an answer first
27application · medium
A malware function allocates several local variables. The prologue is `push ebp; mov ebp, esp; sub esp, 20h`. Later, the code writes to `[ebp-4]`, `[ebp-8]`, and `[ebp-0Ch]`. What is the most accurate interpretation of these memory accesses?
Select an answer first
28application · medium
You are reversing a 32-bit function that begins with `push ebp; mov ebp, esp; sub esp, 10h`. Inside the function, you see an instruction `mov [ebp-8], eax`. What does `[ebp-8]` most likely represent?
Select an answer first
29foundation · easy
In x86 assembly, which instruction is used to perform an unconditional jump to a different location within a function?
Select an answer first
30foundation · easy
In the fastcall calling convention, where is the third argument (if any) passed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Reversing Functions in Assembly GREM Practice Questions (Page 6)

Questions 26–30

A 32-bit malware function uses the fastcall convention. The disassembly shows the function accesses `[esp+4]` to read a value. What does this stack location contain?

A malware function allocates several local variables. The prologue is `push ebp; mov ebp, esp; sub esp, 20h`. Later, the code writes to `[ebp-4]`, `[ebp-8]`, and `[ebp-0Ch]`. What is the most accurate interpretation of these memory accesses?

You are reversing a 32-bit function that begins with `push ebp; mov ebp, esp; sub esp, 10h`. Inside the function, you see an instruction `mov [ebp-8], eax`. What does `[ebp-8]` most likely represent?

In x86 assembly, which instruction is used to perform an unconditional jump to a different location within a function?

In the fastcall calling convention, where is the third argument (if any) passed?

Keep studying — Core Reverse Engineering Concepts