On 32-bit x86 Linux, how are function arguments typically passed to a function?

In registers EAX, EBX, ECX, and EDX

In a dedicated argument block in the data segment

In the floating-point registers ST0-ST3

On the stack, pushed right-to-left

You are developing shellcode for a Linux exploit that will be injected into a buffer at an unknown address. To ensure it executes correctly regardless of where it lands, which property must your shellcode have?

It must be compiled with the -static flag to avoid dynamic linking.

It must be placed in the .text section of the binary.

It must use the call-pop technique to determine the current address.

It must use only relative addressing or obtain its own address at runtime.

What does it mean for shellcode to be position-independent?

It uses absolute memory addresses for all data references

It only runs in the stack segment

It is compiled with a fixed base address

It can be executed from any memory address without modification

You are writing x86-64 Linux shellcode that needs to invoke the execve system call to execute /bin/sh. You have already set up the registers so that RAX contains the syscall number for execve. What must you do next to actually perform the system call?

Execute the int 0x80 instruction.

Execute the ret instruction to return to the kernel.

Execute the syscall instruction.

Call the libc function system() directly.

Why is it important to avoid null bytes (0x00) in shellcode that is copied using string functions like strcpy?

Null bytes are interpreted as the end of the string, truncating the shellcode

Null bytes cause the CPU to execute a privileged instruction

Null bytes are used as a separator between instructions

Null bytes are removed by the kernel before execution

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 1

Linux Execution, Memory, and Shellcode Foundations GXPN Practice Questions (Page 7)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

Questions 31–35

31foundation · easy
On 32-bit x86 Linux, how are function arguments typically passed to a function?
Select an answer first
32application · medium
You are developing shellcode for a Linux exploit that will be injected into a buffer at an unknown address. To ensure it executes correctly regardless of where it lands, which property must your shellcode have?
Select an answer first
33foundation · easy
What does it mean for shellcode to be position-independent?
Select an answer first
34application · medium
You are writing x86-64 Linux shellcode that needs to invoke the execve system call to execute /bin/sh. You have already set up the registers so that RAX contains the syscall number for execve. What must you do next to actually perform the system call?
Select an answer first
35foundation · easy
Why is it important to avoid null bytes (0x00) in shellcode that is copied using string functions like strcpy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.