How does ASLR (Address Space Layout Randomization) complicate shellcode exploitation?

It randomizes the addresses of key memory regions, making it difficult to hard-code addresses in shellcode or return addresses

It encrypts the shellcode when it is loaded into memory

It prevents the use of the syscall instruction

It marks the stack as non-executable

When a function is called on x86-64 Linux, which value is pushed onto the stack by the CALL instruction before control transfers to the function?

The stack pointer of the caller

The first argument to the function

The address of the next instruction after the CALL

In an XOR-encoded shellcode, where does the decoder stub typically reside?

In a separate memory region allocated by the kernel

Before the encoded payload, so it executes first and decodes the following bytes

After the encoded payload, so it decodes the preceding bytes

In the stack segment, separate from the payload

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 1

Linux Execution, Memory, and Shellcode Foundations GXPN Practice Questions (Page 5)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

Questions 21–25

21foundation · easy
How does ASLR (Address Space Layout Randomization) complicate shellcode exploitation?
Select an answer first
22foundation · easy
When a function is called on x86-64 Linux, which value is pushed onto the stack by the CALL instruction before control transfers to the function?
Select an answer first
23foundation · easy
On x86-64 Linux, which register holds the syscall number when invoking a system call via the syscall instruction?
Select an answer first
24foundation · easy
In an XOR-encoded shellcode, where does the decoder stub typically reside?
Select an answer first
25application · easy
You are analyzing a Linux binary and need to find where dynamically allocated memory is placed in the process address space. Which segment should you examine?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Linux Execution, Memory, and Shellcode Foundations GXPN Practice Questions (Page 5)

Questions 21–25

How does ASLR (Address Space Layout Randomization) complicate shellcode exploitation?

When a function is called on x86-64 Linux, which value is pushed onto the stack by the CALL instruction before control transfers to the function?

On x86-64 Linux, which register holds the syscall number when invoking a system call via the syscall instruction?

In an XOR-encoded shellcode, where does the decoder stub typically reside?

You are analyzing a Linux binary and need to find where dynamically allocated memory is placed in the process address space. Which segment should you examine?

Keep studying — Exploitation Foundations and Memory Corruption