What is the primary purpose of XOR encoding in shellcode?

To compress the shellcode so it occupies less memory

To transform the shellcode bytes so they avoid bad characters like null bytes

To add error-correction codes to the shellcode

To encrypt the shellcode so only the intended target can execute it

You are developing shellcode for a Linux x86-64 target where ASLR is enabled and you cannot predict the absolute address where your shellcode will be loaded. You need the shellcode to execute correctly regardless of its location in memory. What is the most important property your shellcode must have?

It must be compiled with the -static flag to avoid dynamic linking issues.

It must be placed in the .text section of the binary to ensure it is executable.

It must be position-independent, using relative addressing or RIP-relative instructions to reference data and code within the payload.

It must use absolute addresses for all memory references to ensure the correct data is accessed.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 1

Linux Execution, Memory, and Shellcode Foundations GXPN Practice Questions (Page 6)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

Questions 26–30

26foundation · easy
On a little-endian system, how is the 32-bit integer 0x12345678 stored in memory starting at address 0x1000?
Select an answer first
27foundation · easy
What is the primary purpose of XOR encoding in shellcode?
Select an answer first
28application · medium
You are developing shellcode for a Linux x86-64 target where ASLR is enabled and you cannot predict the absolute address where your shellcode will be loaded. You need the shellcode to execute correctly regardless of its location in memory. What is the most important property your shellcode must have?
Select an answer first
29foundation · easy
When writing shellcode to spawn a shell on Linux x86-64, which system call is commonly used, and what is its syscall number?
Select an answer first
30application · medium
You are writing shellcode for a Linux x86-64 target that will be injected into a buffer on the heap. The heap address is randomized by ASLR, so you cannot hardcode the address of your data. Which x86-64 instruction is most useful for accessing data relative to the current instruction pointer?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Linux Execution, Memory, and Shellcode Foundations GXPN Practice Questions (Page 6)

Questions 26–30

On a little-endian system, how is the 32-bit integer 0x12345678 stored in memory starting at address 0x1000?

What is the primary purpose of XOR encoding in shellcode?

When writing shellcode to spawn a shell on Linux x86-64, which system call is commonly used, and what is its syscall number?

You are writing shellcode for a Linux x86-64 target that will be injected into a buffer on the heap. The heap address is randomized by ASLR, so you cannot hardcode the address of your data. Which x86-64 instruction is most useful for accessing data relative to the current instruction pointer?

Keep studying — Exploitation Foundations and Memory Corruption