Windows Execution and Memory Foundations GXPN Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A penetration tester is crafting a ROP chain for a Windows 10 x64 application. They need to find a 'pop rsp; ret' gadget. Which memory region is most likely to contain such a gadget if ASLR is enabled?

   • AThe stack
   • BThe heap
   • CA non-ASLR-loaded DLL
   • DThe main executable if it is ASLR-enabled
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which structure in Windows is used to translate a virtual address to a physical address for a given process?

   • AMemory Management Unit (MMU)
   • BTranslation Lookaside Buffer (TLB)
   • CPage Table (with PTEs)
   • DPage Directory Base Register (PDBR)
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   You are analyzing a 64-bit Windows binary that uses stack cookies and /GS. You have found a stack overflow in a function that has a local buffer and a stack cookie. You have an arbitrary read primitive that allows you to read the stack cookie. However, the function also uses a security check that validates the stack pointer (RSP) after the cookie check. Which exploitation technique is most likely to bypass both protections?

   • AUse a heap overflow to overwrite the stack cookie and return address simultaneously.
   • BUse the arbitrary read to obtain the stack cookie and the stack pointer, then craft a ROP chain that restores the original RSP before returning.
   • COverwrite the stack cookie with the correct value and then overwrite the return address with a ROP gadget.
   • DDisable the stack cookie check by overwriting the global security cookie in the .data section.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In a PE file, which table is used to resolve functions imported from other DLLs?

   • AResource Table
   • BExport Address Table (EAT)
   • CImport Address Table (IAT)
   • DBase Relocation Table
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A penetration tester is analyzing a Windows process that loads a DLL at runtime using LoadLibrary. They want to understand how the loader handles the DLL's imports. Which step occurs first when the DLL is loaded?

   • AThe loader calls the DLL's entry point (DllMain).
   • BThe loader maps the DLL into the process's virtual address space.
   • CThe loader applies ASLR to the DLL's base address.
   • DThe loader resolves the DLL's imports by walking the IAT.
   Reveal Solution Discussion Select an answer first