In a typical x86-64 function prologue, which two operations are performed to set up a new stack frame?

Push the return address and jump to the function

Push the base pointer and set the base pointer to the current stack pointer

Increment the stack pointer and store local variables in registers

Pop the base pointer and return to the caller

Your exploit for a Linux target requires shellcode, but the application filters input and rejects any bytes that include 0x00, 0x0a, or 0x0d. You decide to encode your shellcode with a single-byte XOR key. What is the most important additional consideration for the decoder stub?

The decoder stub itself must not contain the filtered bytes, and the XOR key must be chosen so that the encoded payload avoids them.

The XOR key must be a multiple of 4 to ensure proper alignment of the decoded instructions.

The decoder stub must be placed in an executable memory region, and the encoded payload must be in a writable region.

The decoder must use a loop that decrements a counter, and the encoded payload must be stored in the .data section.

You are debugging a crash in a Linux x86-64 program. The crash occurs in a function that was called from main(). You are examining the stack and notice that the return address is stored at a certain location. According to the standard stack frame layout, what is stored immediately below the return address (at a lower memory address) on the stack?

The arguments passed to the current function.

The instruction pointer of the current function.

The saved frame pointer (RBP) of the calling function.

The local variables of the calling function.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 1

Linux Execution, Memory, and Shellcode Foundations GXPN Practice Questions (Page 1)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

Questions 1–5

1application · easy
You are analyzing a Linux binary and need to determine where a global variable initialized to zero is stored. The binary is not stripped. Which memory segment should you examine?
Select an answer first
2foundation · easy
In a typical x86-64 function prologue, which two operations are performed to set up a new stack frame?
Select an answer first
3application · medium
Your exploit for a Linux target requires shellcode, but the application filters input and rejects any bytes that include 0x00, 0x0a, or 0x0d. You decide to encode your shellcode with a single-byte XOR key. What is the most important additional consideration for the decoder stub?
Select an answer first
4application · medium
You are debugging a crash in a Linux x86-64 program. The crash occurs in a function that was called from main(). You are examining the stack and notice that the return address is stored at a certain location. According to the standard stack frame layout, what is stored immediately below the return address (at a lower memory address) on the stack?
Select an answer first
5application · easy
While analyzing a memory dump from a little-endian x86 system, you find the 4 bytes 0x78 0x56 0x34 0x12 at a particular address. What 32-bit value does this represent?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Linux Execution, Memory, and Shellcode Foundations GXPN Practice Questions (Page 1)

Questions 1–5

You are analyzing a Linux binary and need to determine where a global variable initialized to zero is stored. The binary is not stripped. Which memory segment should you examine?

In a typical x86-64 function prologue, which two operations are performed to set up a new stack frame?

Your exploit for a Linux target requires shellcode, but the application filters input and rejects any bytes that include 0x00, 0x0a, or 0x0d. You decide to encode your shellcode with a single-byte XOR key. What is the most important additional consideration for the decoder stub?

While analyzing a memory dump from a little-endian x86 system, you find the 4 bytes 0x78 0x56 0x34 0x12 at a particular address. What 32-bit value does this represent?

Keep studying — Exploitation Foundations and Memory Corruption