I85PREP
⌘ K
OSED study materials
OSED study resources

OSED practice questions

One question at a time. Build your OSED understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Reverse engineering binary applications to locate vulnerabilities

During static analysis of a Windows PE, which structure directly maps a virtual address in a loaded image to the file offset of the raw data that initializes it?

  1. The export address table directory indexed by the RVA
  2. The section table entry whose VirtualAddress and VirtualSize range contains the RVA, combined with SizeOfRawData and PointerToRawData Correct answer.
  3. The import address table thunk array indexed by the RVA
  4. The base relocation block whose Page RVA is closest to the target RVA

Explanation

Mapping an RVA to a file offset requires locating the section whose virtual range covers the RVA, then applying the delta between the RVA and the section VirtualAddress to PointerToRawData, bounded by SizeOfRawData. Export, import, and relocation directories are metadata tables, not address translation mechanisms.

Question 2Reverse engineering binary applications to locate vulnerabilities

A crash dump shows the instruction pointer inside a function prologue that executes `sub esp, 0x400` followed by a `rep movsb` copying attacker-supplied data. Which vulnerability class should the reverse engineer investigate first?

  1. Use-after-free caused by a stale heap pointer
  2. Integer truncation in a file-size comparison
  3. Stack-based buffer overflow from an unchecked copy length Correct answer.
  4. Format string write through a user-controlled format argument

Explanation

A large stack allocation followed by a repeat-move string copy indicates a fixed stack buffer being filled by a length-controlled copy. If the copy count derives from untrusted input without a bound check, the saved return address and stack canary region can be overwritten.

Question 3Reverse engineering binary applications to locate vulnerabilities

Which artifact in a PE file most directly reveals that the binary was compiled with stack cookie protection enabled?

  1. The presence of a TLS callback array in the data directory
  2. The presence of a Rich header with a specific product ID
  3. The presence of an export directory with ordinal-only exports
  4. The presence of a load configuration directory containing a security cookie field Correct answer.

Explanation

When /GS is used, the linker emits a load configuration directory whose SecurityCookie field points at the cookie global used by the prologue and epilogue checks. The Rich header records toolchain build metadata, not mitigation state.

Question 4Reverse engineering binary applications to locate vulnerabilities

While triaging a crash, you observe the overwritten return address contains bytes that are non-canonical on x64. What does this most likely indicate about the exploitation attempt?

  1. The binary was compiled without ASLR and the address is simply stale
  2. The attacker successfully achieved code execution in ring 0
  3. The overwrite corrupted the pointer with data that cannot be a valid user or kernel address, so control transfer faults immediately Correct answer.
  4. The crash is caused by a benign race condition in a worker thread

Explanation

On x64, canonical addresses require bits 63 through the sign-extension boundary to match; random overflow bytes usually fail this test. A non-canonical return address means the overwrite occurred but the value cannot map to executable memory, producing an immediate fault.

Question 5Reverse engineering binary applications to locate vulnerabilities

What is the primary purpose of identifying all cross-references to a potentially unsafe string copy function during reverse engineering?

  1. To compute the entropy of the code section
  2. To determine the compiler version used to build the binary
  3. To recover the original source file names embedded in the binary
  4. To enumerate every call site that may pass attacker-controlled data into the vulnerable routine Correct answer.

Explanation

Cross-reference analysis maps each caller of a risky API so the analyst can trace where its arguments originate. This narrows the search to call sites reachable from untrusted input such as network or file parsing paths.

Question 6Reverse engineering binary applications to locate vulnerabilities

A function reads a 16-bit length field from a network packet, allocates that many bytes, then copies the length value in bytes from the packet buffer. Which issue is most likely present?

  1. A stack overflow because the allocation occurs on the stack
  2. A heap overflow because the length field is trusted without validating it against the actual received bytes Correct answer.
  3. A type confusion because the length is unsigned
  4. A double free because the buffer is released twice

Explanation

If the declared length exceeds the bytes actually received, the copy reads past the packet buffer and writes attacker-influenced data into a heap allocation sized from the same unvalidated field. The missing check is a comparison between the declared length and the real available data.

Question 7Reverse engineering binary applications to locate vulnerabilities

Which disassembly view is most useful for quickly spotting a switch statement implemented as a jump table?

  1. A list of imported functions sorted by ordinal
  2. A graph view showing an indirect jump whose target table is indexed by a bounded register Correct answer.
  3. A linear sweep of the data section showing ASCII strings
  4. A hex dump of the resource directory

Explanation

Compilers lower dense switch statements into an indirect jump through a table of code offsets, guarded by a range check on the index. Recognizing the compare-and-jump-table idiom lets the analyst enumerate all case targets.

Question 8Reverse engineering binary applications to locate vulnerabilities

An analyst wants to confirm that a suspicious arithmetic routine is reachable from the network receive handler. Which approach best establishes that reachability?

  1. Build a call graph from the receive handler and check whether the routine appears in the transitive closure Correct answer.
  2. Search the binary for the routine's name in the export table
  3. Compare the routine's byte size against neighboring functions
  4. Check whether the routine contains any floating-point instructions

Explanation

Reachability from an input source is established by following call edges from the receive handler through its callees. A transitive call graph traversal shows whether the target routine can be invoked along that path.

Question 9Reverse engineering binary applications to locate vulnerabilities

A binary contains a function that calls `VirtualProtect` with PAGE_EXECUTE_READWRITE on a buffer filled from a network socket. What should the reverse engineer conclude?

  1. The binary likely decrypts or generates code at runtime, warranting dynamic analysis of the buffer contents Correct answer.
  2. The binary is statically linked with the C runtime
  3. The binary uses structured exception handling for recovery
  4. The binary has no mitigations enabled

Explanation

Making a data buffer executable after filling it from input is a classic pattern for runtime code generation or self-decrypting payloads. The analyst should breakpoint after the protection change and dump the buffer to see what will execute.

Question 10Reverse engineering binary applications to locate vulnerabilities

During dynamic analysis, a breakpoint on `strcpy` fires with the destination pointing into a stack frame and the source pointing to a socket buffer. Which follow-up action best confirms exploitability?

  1. Inspect the PE checksum
  2. Dump the import table to check for ASLR
  3. Enumerate the binary's exported functions
  4. Measure the source length relative to the distance from the destination to the saved return address Correct answer.

Explanation

Exploitability of a stack copy depends on whether the copied length can exceed the space between the destination buffer and the saved return address or canary. Comparing those distances tells the analyst how much input is needed to reach control data.

Question 11Reverse engineering binary applications to locate vulnerabilities

A parser function performs `memcpy(dst, src, count)` where count is a 32-bit value read from the input, and dst is a heap chunk allocated with `malloc(count + 8)`. Which arithmetic condition could still yield a heap overflow?

  1. count equal to 0xFFFFFFF8 so that count + 8 wraps to zero while the copy uses the original count Correct answer.
  2. count smaller than the chunk header size
  3. count equal to the exact size of the source buffer
  4. count equal to zero so that no copy occurs

Explanation

Adding a small constant to a near-maximum 32-bit length wraps the allocation size to a tiny value, while the subsequent copy still uses the large original count. This integer overflow defeats the intended slack in the allocation.

Question 12Reverse engineering binary applications to locate vulnerabilities

Which technique best recovers the arguments passed to a function in a stripped x64 binary compiled with the Microsoft calling convention?

  1. Read the arguments from the EAX, EBX, ECX, and EDX registers
  2. Read the arguments from the stack at [ESP+4] onward
  3. Read the arguments from the floating-point stack
  4. Read the first four arguments from RCX, RDX, R8, and R9 at the call site or function entry Correct answer.

Explanation

The Microsoft x64 convention passes the first four integer or pointer arguments in RCX, RDX, R8, and R9, with additional arguments on the stack. Recognizing this at call sites lets the analyst trace tainted values into callees.

Question 13Reverse engineering binary applications to locate vulnerabilities

A function contains a loop that copies bytes one at a time until it encounters a NUL, with no bound on the destination. Which vulnerability is most consistent with this pattern?

  1. Race condition on a shared global counter
  2. Missing authentication check on an administrative API
  3. Off-by-one or unbounded string copy leading to a write past the destination buffer Correct answer.
  4. Use of uninitialized memory in a struct field

Explanation

A byte-at-a-time loop terminated by a NUL delimiter implements a string copy without a length limit. If the source is longer than the destination, the loop writes past the buffer boundary.

Question 14Reverse engineering binary applications to locate vulnerabilities

What does an analyst gain by comparing a function's static disassembly against its behavior observed under a debugger?

  1. Guaranteed identification of the compiler's optimization level
  2. Proof that the binary is free of vulnerabilities
  3. Detection of runtime patching or decryption that changes the executed instructions from the on-disk bytes Correct answer.
  4. Recovery of the original source code comments

Explanation

Packers and self-modifying code alter instructions after load, so the on-disk disassembly differs from what executes. Comparing static and dynamic views reveals unpacking stubs and decrypted regions that must be analyzed separately.

Question 15Reverse engineering binary applications to locate vulnerabilities

A binary resolves API addresses at runtime by walking the export table of loaded modules rather than importing them statically. Why does this complicate vulnerability analysis?

  1. The binary cannot be disassembled by standard tools
  2. The dangerous calls do not appear in the import table, so xrefs to them must be recovered from the resolver logic Correct answer.
  3. The binary must be running in kernel mode
  4. The binary cannot use the stack

Explanation

Dynamic API resolution hides the true callees from the static import directory, so an analyst must identify the resolver and the hashed or string names it uses. Only after recovering those mappings can cross-references to risky functions be established.

Question 16Reverse engineering binary applications to locate vulnerabilities

Which condition most strongly suggests a format string vulnerability in a logging function?

  1. A user-supplied buffer is passed directly as the format argument to a printf-family call Correct answer.
  2. The log message is copied into a fixed buffer with strncpy
  3. The log level is read from a configuration file
  4. The log file is opened with append mode

Explanation

When untrusted data occupies the format parameter position, conversion specifiers such as %n and %s are interpreted by the formatter. This allows memory reads and writes controlled by the attacker's input string.

Question 17Reverse engineering binary applications to locate vulnerabilities

An analyst finds a function that allocates an object, stores a pointer in a global, frees the object on an error path, but leaves the global pointer intact. What vulnerability does this enable?

  1. Stack exhaustion from deep recursion
  2. Integer underflow in the allocation size
  3. Use-after-free when later code dereferences the stale global pointer Correct answer.
  4. Format string write through the global pointer

Explanation

Freeing an object without clearing every alias leaves a dangling pointer that subsequent code may dereference. An attacker who can influence reallocation of that memory can control the contents seen through the stale reference.

Question 18Reverse engineering binary applications to locate vulnerabilities

Which approach most reliably identifies the exact input offset that overwrites a saved return address in a crash-prone network service?

  1. Disable ASLR and rerun the service repeatedly
  2. Compare the binary's hash against a known database
  3. Send a long string of a single repeated byte and observe the crash
  4. Send a cyclic pattern of unique subsequences and read the faulting instruction pointer from the crash to compute the offset Correct answer.

Explanation

A cyclic pattern lets the analyst locate the overwritten value's position by finding the faulting bytes within the pattern. This yields the precise offset without guessing at buffer boundaries.

Question 19Reverse engineering binary applications to locate vulnerabilities

A function uses `sprintf` into a 64-byte stack buffer with a format string containing multiple `%s` conversions of attacker-controlled strings. Which property of sprintf makes this dangerous?

  1. It always appends a newline that overflows the buffer
  2. It encrypts the output before writing
  3. It allocates a new heap buffer for each conversion
  4. It performs no bounds checking on the total formatted output length Correct answer.

Explanation

sprintf writes the fully formatted result without regard to the destination size, so the combined length of all conversions can exceed the buffer. Multiple %s conversions of long strings make the overflow easy to trigger.

Question 20Reverse engineering binary applications to locate vulnerabilities

Why is identifying the location of the stack canary in a function prologue important when assessing a stack overflow?

  1. The canary enables the NX bit at runtime
  2. The overwrite must preserve the canary value to reach the saved return address without triggering a check failure Correct answer.
  3. The canary determines the base address of the code section
  4. The canary controls the heap allocator's chunk size

Explanation

The epilogue compares the stored canary against the global cookie and aborts on mismatch, so an overflow that clobbers it terminates before returning. An exploit must either avoid the canary bytes or leak the cookie value first.

Question 21Reverse engineering binary applications to locate vulnerabilities

An analyst observes a function that computes a destination index as `idx = user_index * 4` and then writes to `table[idx]` without comparing user_index to the table length. Which vulnerability class applies?

  1. Type confusion between signed and unsigned table entries
  2. Uninitialized read of table entries
  3. Out-of-bounds write due to a missing index bounds check Correct answer.
  4. Double free due to repeated release of table entries

Explanation

Scaling an unvalidated index and using it as an array offset allows writes outside the table's allocated range. The missing comparison against the element count is the root cause.

Question 22Reverse engineering binary applications to locate vulnerabilities

A binary's entry point contains a short stub that decompresses a large blob into a new section and then jumps into it. Which analysis strategy is most appropriate?

  1. Rely solely on static disassembly of the on-disk file
  2. Patch the entry point to return immediately and analyze only the stub
  3. Discard the binary as unanalyzable
  4. Run the binary under a debugger, break after the decompression completes, and dump the unpacked image from memory Correct answer.

Explanation

Packed binaries reveal their real code only after the stub reconstructs it in memory, so the executable region must be dumped once decompression finishes. Static analysis of the on-disk file shows only the stub and compressed data.

Question 23Reverse engineering binary applications to locate vulnerabilities

A function validates a length with `if (len > 0x100) return error;` where len is a signed 32-bit integer, then calls `memcpy(dst, src, len)`. Which input defeats the check?

  1. A len larger than 0x100, which the check rejects
  2. A len of exactly 0x100, which is rejected by the comparison
  3. A negative len such as 0xFFFFFF00, which passes the comparison as signed and is then treated as a huge unsigned size by memcpy Correct answer.
  4. A len of zero, which causes the copy to be skipped

Explanation

The comparison is performed on a signed value, so negative numbers satisfy len <= 0x100 and pass. memcpy takes a size_t, converting the negative value into a very large unsigned count and causing an overflow.

Question 24Reverse engineering binary applications to locate vulnerabilities

During exploit development against a non-ASLR binary with DEP enabled, an analyst finds a `jmp esp` sequence in a module marked non-ASLR. Why is this useful?

  1. It enables SEH overwrite without a crash
  2. It disables DEP for the process
  3. It leaks the stack canary value
  4. It provides a stable instruction pointer redirection into attacker-controlled stack data, forming a ROP pivot Correct answer.

Explanation

A reliable jmp esp gadget converts a return-address overwrite into execution flow into the stack buffer, which is the first step of a ROP chain that works around DEP. Stability comes from the module not being randomized.

Question 25Reverse engineering binary applications to locate vulnerabilities

A service parses a message with a 1-byte type field followed by a 2-byte big-endian length and then dispatches to a handler that trusts the length for a stack copy. Which reasoning best explains why the big-endian encoding matters for exploitation?

  1. The type field is ignored by the dispatcher
  2. The analyst must byte-swap the length when crafting input so the decoded value matches the intended overflow size Correct answer.
  3. The length field is always validated before dispatch
  4. Big-endian encoding prevents any overflow from occurring

Explanation

If the parser converts the field with a byte-swap before use, the wire bytes must be arranged so the post-swap value equals the desired length. Sending the raw little-endian representation would produce a different decoded size and fail to reach the target offset.

Question 26Reverse engineering binary applications to locate vulnerabilities

When reverse engineering a stripped Windows binary to locate a buffer overflow, which static analysis artifact most directly reveals the size of a stack buffer allocated in a function?

  1. The relocation table entries for the code section
  2. The disassembly of the function prologue showing the subtraction from the stack pointer Correct answer.
  3. The export directory listing the function name
  4. The import address table entry for the function

Explanation

In x86 and x64 code, local stack buffers are typically allocated by subtracting their total size from ESP/RSP in the function prologue. The immediate value in that subtraction often equals the combined size of all locals, and with careful review it can be attributed to individual buffers. The import address table, export directory, and relocation table do not encode local stack frame layout.

Question 27Reverse engineering binary applications to locate vulnerabilities

An analyst is reviewing a function that copies data into a destination buffer using a length value derived from user input. Which decompiler feature is most useful for quickly tracing where that length value originates?

  1. The cross-reference list for the length variable Correct answer.
  2. The string table showing error messages
  3. The function's stack frame size
  4. The list of imported cryptographic APIs

Explanation

Cross-references show every location where a variable is read or written, allowing the analyst to walk backward from the copy to the input source. This data-flow tracing is the core of determining whether the length is attacker-controlled and properly bounded. String tables, stack frame sizes, and import lists provide context but do not directly trace value provenance.

Question 28Reverse engineering binary applications to locate vulnerabilities

Which section of a Portable Executable (PE) file most commonly contains the executable code that an analyst disassembles when searching for vulnerabilities?

  1. .data
  2. .rdata
  3. .reloc
  4. .text Correct answer.

Explanation

The .text section holds the machine instructions executed by the processor and is the primary target for disassembly. Vulnerability hunting focuses on this code because parsing, copying, and arithmetic logic lives here. The other sections hold read-only data, writable data, and relocation information respectively.

Question 29Reverse engineering binary applications to locate vulnerabilities

During static review of a function, an analyst sees a call to `lstrcpyA` with the destination pointing to a global array and the source pointing to a buffer filled by a network receive handler. What is the most significant vulnerability indicator in this pattern?

  1. The use of a global array as the destination
  2. The choice of the ANSI version of the string copy API
  3. The fact that the source buffer is filled by a receive handler
  4. The unbounded copy of network-controlled data into a fixed-size global buffer Correct answer.

Explanation

`lstrcpyA` copies until a NUL terminator without regard to the destination size, so network-controlled data can overflow the fixed global array. The critical issue is the absence of a length bound on attacker-influenced input, not the storage class of the destination. Using the ANSI variant or receiving data over the network is normal and not itself a vulnerability.

Question 30Reverse engineering binary applications to locate vulnerabilities

An analyst wants to determine whether a suspicious function is called from a network-facing code path in a large stripped binary. Which approach is most efficient for establishing this reachability?

  1. Running the binary under a debugger and setting a breakpoint on every API call
  2. Comparing the function's size against known library functions
  3. Searching the binary for the function's byte signature in all sections
  4. Building a call graph from the network receive handler and checking whether the function appears Correct answer.

Explanation

A call graph rooted at the network receive handler shows which functions are reachable from attacker-influenced input. If the suspicious function appears in that graph, it is reachable from the network path. Byte-signature searches, broad API breakpoints, and size comparisons do not establish call-path reachability.

Question 31Reverse engineering binary applications to locate vulnerabilities

While reviewing a function that parses a length-prefixed record, an analyst notices the length is read as a 16-bit unsigned value, sign-extended into a 32-bit register, and then used as the count argument to `memcpy`. Which follow-on check is most important to verify whether an overflow is possible?

  1. Whether the record parser runs on a separate thread
  2. Whether the length is validated against the actual remaining input size before the copy Correct answer.
  3. Whether the destination buffer size is at least 0xFFFF bytes
  4. Whether the memcpy call is imported or resolved dynamically

Explanation

Even a 16-bit length can exceed a small destination buffer, so the decisive question is whether the code confirms that the declared length fits both the destination and the available input. Without that validation, an attacker can supply a length larger than the buffer. Destination size of 0xFFFF, import resolution, and threading do not determine whether this specific copy is bounded.

Question 32Reverse engineering binary applications to locate vulnerabilities

An analyst is examining an x64 binary compiled with the Microsoft calling convention and wants to identify the arguments to a function that has no symbols. Which registers should be inspected first at the function entry?

  1. RAX, RBX, RSI, RDI
  2. RSP, RBP, R10, R11
  3. XMM0, XMM1, XMM2, XMM3
  4. RCX, RDX, R8, R9 Correct answer.

Explanation

The Microsoft x64 calling convention passes the first four integer or pointer arguments in RCX, RDX, R8, and R9. Additional arguments are placed on the stack. RAX, RBX, RSI, and RDI are not argument registers in this convention, and XMM registers are used for floating-point arguments.

Question 33Reverse engineering binary applications to locate vulnerabilities

A function contains a loop that reads bytes from an input stream and writes each byte to a fixed-size stack buffer until it encounters a newline character. No other length check is present. Which vulnerability class is most directly indicated?

  1. Stack-based buffer overflow Correct answer.
  2. Format string vulnerability
  3. Integer underflow
  4. Use-after-free

Explanation

The loop copies input bytes into a fixed-size stack buffer without limiting the number of bytes written, so an input line longer than the buffer overwrites adjacent stack memory. This is a classic stack-based buffer overflow. Use-after-free, integer underflow, and format string issues involve different mechanisms.

Question 34Reverse engineering binary applications to locate vulnerabilities

When assessing a potential stack overflow in a function compiled with stack cookies, which fact about the function prologue is most relevant to determining whether the overflow can reach the saved return address?

  1. The size of the .text section containing the function
  2. The position of the canary value relative to the buffers and the saved return address Correct answer.
  3. The number of arguments the function receives
  4. The order in which local buffers are declared in the source

Explanation

The stack canary is placed between local buffers and the saved return address, so an overflow must first overwrite the canary before reaching the return address. Knowing the canary's position helps determine whether a linear overflow will trigger the canary check. Declaration order, argument count, and section size do not directly affect whether the return address is reachable.

Question 35Reverse engineering binary applications to locate vulnerabilities

An analyst finds a function that writes to an array using an index calculated as `idx = user_value * 8` and then stores a pointer at `array[idx]`. Which property of `user_value` must be verified to determine whether an out-of-bounds write is possible?

  1. Whether the array is allocated on the heap or in a global section
  2. Whether the function containing the write is exported
  3. Whether `user_value` is signed and whether its range is checked against the array bounds Correct answer.
  4. Whether `user_value` is stored in a register or on the stack

Explanation

The index is derived directly from user input, so the critical question is whether the code constrains `user_value` to the array's valid index range. Signedness matters because negative values can also produce out-of-bounds offsets. Register allocation, storage location, and export status do not determine whether the index is bounded.

Question 36Reverse engineering binary applications to locate vulnerabilities

A binary's entry point contains a short stub that decompresses a large blob into a newly allocated section and then transfers control into it. Why is this pattern important to recognize when locating vulnerabilities?

  1. It indicates the binary uses a packer, so static analysis of the unpacked code requires dumping the new section after decompression Correct answer.
  2. It shows that the binary has no imported functions
  3. It proves the binary is written in a managed language
  4. It guarantees the unpacked code is free of buffer overflows

Explanation

A decompression stub that creates and jumps into a new section is characteristic of runtime packing. The real code is not visible in the static image, so the analyst must let the stub run and dump the unpacked section before disassembling it. Managed-language use, absence of imports, and absence of vulnerabilities are not implied by this pattern.

Question 37Reverse engineering binary applications to locate vulnerabilities

An analyst is reviewing a function that calls `VirtualProtect` with `PAGE_EXECUTE_READWRITE` on a buffer filled from a network socket, then calls a function pointer stored in that buffer. Which conclusion is most strongly supported?

  1. The buffer is used only for data storage and cannot be executed
  2. The code intentionally enables execution of network-supplied data, creating a direct code-execution path Correct answer.
  3. The function pointer is resolved through the import address table
  4. The `VirtualProtect` call is a standard compiler-generated stack cookie check

Explanation

Marking a network-filled buffer executable and then calling into it allows attacker-supplied bytes to run as code. This is a direct path to arbitrary code execution if the attacker controls the buffer contents. The other options contradict the observed behavior or misidentify standard compiler mechanisms.

Question 38Reverse engineering binary applications to locate vulnerabilities

During reverse engineering of a function that parses a message, an analyst identifies a 1-byte type field followed by a 2-byte big-endian length and then a dispatch to a handler based on the type. Which static artifact best helps enumerate all possible handler targets?

  1. The relocation entries for the code section
  2. The string table containing handler names
  3. The switch statement's jump table in the disassembly Correct answer.
  4. The import address table entries for socket APIs

Explanation

A dispatch on a small integer type is often compiled into a jump table, which lists the addresses of all handler blocks. Examining the jump table in the disassembly reveals every possible target and helps ensure no handler is missed. String tables, relocations, and socket imports do not enumerate dispatch targets.

Question 39Reverse engineering binary applications to locate vulnerabilities

An analyst discovers a function that allocates an object, stores a pointer to it in a global variable, frees the object on an error path, and later dereferences the global pointer in a cleanup routine without clearing it. Which vulnerability does this pattern most directly suggest?

  1. Use-after-free Correct answer.
  2. Off-by-one write
  3. Stack exhaustion
  4. Race condition in file access

Explanation

The global pointer is freed on one path but remains accessible, and a later dereference in cleanup uses the dangling pointer. This is the defining pattern of a use-after-free. Stack exhaustion, off-by-one writes, and file-access races involve different mechanisms.

Question 40Reverse engineering binary applications to locate vulnerabilities

A function validates a length with `if (len > 0x100) return error;` where `len` is a signed 32-bit integer, and then calls `memcpy(dst, src, len)` into a 256-byte stack buffer. Which input value most directly demonstrates a bypass of the intended bound?

  1. 0x00000100
  2. 0xFFFFFFFF Correct answer.
  3. 0x00000001
  4. 0x000000FF

Explanation

Because `len` is signed, 0xFFFFFFFF represents -1, which is not greater than 0x100 and passes the check. When passed to `memcpy`, the value is converted to a large unsigned size_t, causing a massive overflow. The other values are either within the intended bound or exactly at the boundary.

Question 41Stack buffer overflow exploitation

During an OSED-style stack overflow exercise, which register holds the return address that a classic EIP-overwrite controls on 32-bit x86?

  1. ECX
  2. EIP Correct answer.
  3. EBP
  4. ESP

Explanation

On 32-bit x86 the instruction pointer is EIP, and a stack overflow that overwrites a saved return address gains control of EIP when the function returns. ESP points to the top of stack and EBP is the frame pointer, so neither is the value jumped to.

Question 42Stack buffer overflow exploitation

A function declares `char buf[64];` and copies attacker data with `strcpy`. Which region of the stack frame is overwritten first as the copy grows past the buffer boundary?

  1. The saved return address
  2. Adjacent stack canary, if present Correct answer.
  3. The function's own local variables
  4. The saved frame pointer

Explanation

On a typical stack layout the buffer sits at the lowest address, and the next object moving toward higher addresses is a stack canary when one is present, then the saved frame pointer, then the return address. Therefore the canary is corrupted before EBP or EIP.

Question 43Stack buffer overflow exploitation

Which condition must hold for a stack buffer overflow to overwrite a saved return address?

  1. The copy length must exceed the distance from buffer start to the saved return address Correct answer.
  2. The buffer must be larger than the page size
  3. The program must be compiled with optimization disabled
  4. The buffer must be allocated on the heap

Explanation

Overwriting the return address requires writing past the buffer and any intervening data, so the input length must exceed the offset from the start of the buffer to the saved return address. Heap allocation, optimization level, and page size are not prerequisites.

Question 44Stack buffer overflow exploitation

What is the purpose of a NOP sled in a stack overflow exploit payload?

  1. To restore the original stack canary value
  2. To increase the chance that execution lands on a valid instruction before the shellcode Correct answer.
  3. To bypass ASLR by leaking a module base
  4. To decrypt the shellcode at runtime

Explanation

A NOP sled is a run of no-operation instructions placed before the shellcode so that an imprecise jump into the sled slides down to the payload. It does not decrypt, repair canaries, or leak addresses.

Question 45Stack buffer overflow exploitation

In a 32-bit x86 payload, the bytes `\x90\x90\xc3` are placed at the overwritten return address target. What behavior results when the function returns?

  1. The process performs an indirect jump through EAX
  2. The process executes a call to the next instruction
  3. The process executes two NOPs and then a ret Correct answer.
  4. The process triggers an int3 breakpoint

Explanation

0x90 is the NOP opcode and 0xC3 is ret, so execution flows through two no-operations and then returns again using the next stack slot. This is the basis of stack pivoting and multi-stage return chains.

Question 46Stack buffer overflow exploitation

Which mitigation places a random value between local buffers and the saved return address and checks it before returning?

  1. ASLR
  2. Stack canary Correct answer.
  3. SafeSEH
  4. DEP/NX

Explanation

A stack canary is a random sentinel stored between the buffer and saved control data; the epilogue verifies it and aborts if it changed. DEP marks memory non-executable, ASLR randomizes base addresses, and SafeSEH validates exception handlers.

Question 47Stack buffer overflow exploitation

What does the instruction `ret` do on x86?

  1. Pops the top of stack into EIP Correct answer.
  2. Pushes EIP onto the stack
  3. Restores EBP from the stack
  4. Adds an immediate to ESP and jumps

Explanation

`ret` pops the dword at ESP into EIP and increments ESP by four, transferring control to the address stored there. `leave` restores EBP, and call pushes the return address.

Question 48Stack buffer overflow exploitation

A researcher wants to find the exact offset at which a cyclic pattern overwrites EIP. Which approach directly yields that offset?

  1. Single-step through the program counting stack pushes
  2. Generate a de Bruijn sequence, crash the program, and read the value in EIP Correct answer.
  3. Disassemble the binary and count local variables
  4. Run the program under a debugger and break on main

Explanation

A de Bruijn or cyclic pattern is unique over its window, so the four bytes seen in EIP identify the exact offset into the input. Counting pushes or local variables is error-prone, and breaking on main does not measure the overwrite distance.

Question 49Stack buffer overflow exploitation

A vulnerable function is compiled with a stack canary, and the overflow occurs in a `strcpy` call. Why does a simple EIP overwrite usually fail?

  1. The canary is checked before the function returns and terminates the process Correct answer.
  2. The canary disables the ret instruction
  3. The canary encrypts the return address so it cannot be overwritten
  4. The canary moves the return address to the heap

Explanation

The function epilogue compares the stored canary with the thread's reference value and calls the failure handler if they differ, so the corrupted return address is never used. The canary does not encrypt the return address, relocate it, or alter the ret instruction.

Question 50Stack buffer overflow exploitation

An exploit overwrites a saved return address with the address of a `jmp esp` instruction in a non-ASLR module. Why is this useful when the stack is non-executable?

  1. It restores the original canary
  2. It decrypts the payload in place
  3. It transfers execution to shellcode placed after the return address on the stack Correct answer.
  4. It marks the stack executable at runtime

Explanation

A `jmp esp` gadget redirects execution to the current stack pointer, which points just past the overwritten return address where the attacker placed shellcode. DEP only blocks executing stack pages, so the gadget must live in executable module memory.