Reversing Functions in Assembly GREM Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   While analyzing a malware binary in IDA Pro, you see a `call sub_401000` instruction followed by `add esp, 8`. The function at `sub_401000` ends with `ret` (no immediate operand). What can you conclude about the calling convention and the number of arguments?

   • Acdecl with 2 arguments; the caller cleans up 8 bytes of stack
   • Bstdcall with 2 arguments; the callee cleans up 8 bytes of stack
   • Cfastcall with 2 arguments; the caller cleans up 8 bytes of stack
   • Dthiscall with 2 arguments; the caller cleans up 8 bytes of stack
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A malware function ends with `mov eax, [ebp-4]; leave; ret`. The caller then immediately executes `test eax, eax; jz failure_path`. What is the function returning?

   • AThe address of a local variable stored at [ebp-4]
   • BThe value of a local variable stored at [ebp-4]
   • CThe return address of the function, which is at [ebp-4]
   • DA constant value that was stored at [ebp-4] during the prologue
   Reveal Solution Discussion Select an answer first