CSC 472 — Quiz 2 — Calling Conventions, System Calls, Shellcode, Stack Overflow, ROP basics

Quiz 2 — Calling Conventions, System Calls, Shellcode, Stack Overflow, ROP basics

12 multiple-choice questions, 1 point each. Closed notes: no slides, no AI tools, no talking. Your instructor will tell you when to start and when to stop. Pick the single best answer for each question, then press Submit quiz.

Your answers are saved in this browser as you go, so a refresh or a dropped connection will not lose your work. If you submit more than once, every submission is recorded.

Your name *

Student ID *

Question 1 1 point

Under the cdecl calling convention, after a function returns, which register holds its return value?

ESP EBP EAX EBX

Question 2 1 point

Which sequence is the standard function prologue that sets up a new stack frame?

push ebp; mov ebp, esp mov esp, ebp; pop ebp pop ebp; ret push eip; call ebp

Question 3 1 point

In a typical 32-bit cdecl stack frame, where does a function find the first argument passed to it?

[ebp+4] [ebp+8] [ebp-4] [esp-8]

Question 4 1 point

On 32-bit Linux, which instruction transfers control from user mode into the kernel to perform a system call (the classic convention)?

call 0x80 jmp 0x80 int 0x80 ret 0x80

Question 5 1 point

Using the int 0x80 convention, which register holds the system-call number?

EAX EBX ECX EDX

Question 6 1 point

Shellcode is usually written to avoid any NUL (0x00) byte because:

The CPU refuses to execute any instruction that contains a 0x00 byte strcpy() / gets() stop copying at the first NUL byte, truncating the payload NUL bytes are reserved for the NOP sled NUL bytes always trigger a stack-canary check

Question 7 1 point

In the jump–call–pop technique for position-independent shellcode, what does the call instruction push onto the stack?

The value of EAX A NUL terminator The return address of main() The address of the bytes right after the call (a pointer to the inline string)

Question 8 1 point

A buffer overflow becomes an exploitable vulnerability, rather than just a crash, the moment that:

The program prints an error message The buffer is declared with char instead of int The attacker controls the exact bytes that overwrite the saved return address The stack happens to grow downward

Question 9 1 point

Why does a cyclic (De Bruijn) pattern let you find the exact offset to the saved return address from a single crash?

Every 4-byte window is unique, so the 4 bytes found in EIP pinpoint one exact offset It fills memory with NOP instructions It makes the stack executable It is the only input format gdb accepts

Question 10 1 point

What problem does a NOP sled solve in a return-to-shellcode attack?

It hides the shellcode from gdb It removes the need for a return address altogether It shrinks the shellcode so it fits in a smaller buffer It turns a guessed, approximate address into a landing zone that slides into the shellcode

Question 11 1 point

In Return-Oriented Programming (ROP), what is a gadget?

A NOP sled placed in front of the shellcode A short sequence of instructions already in the program, ending in ret A tool that finds the offset to EIP New machine code the attacker injects onto the stack

Question 12 1 point

With NX/DEP on (-z noexecstack), injected shellcode on the stack can no longer run. Why does a ROP chain still work?

ROP turns NX off before it runs ROP shellcode is written without NUL bytes The stack holds only addresses; every instruction that runs is existing executable code ROP runs entirely inside the kernel