Q. What does the EAX register contain during a system call?

View solution

Q. What is the IDT?

View solution

Q. What happens when an application calls an operating system API?

View solution

Q. What is the mechanism used by operating systems for switching from user mode to kernel mode?

View solution

Q. Why is it important for reversers to have a basic understanding of executable formats?

View solution

Q. What is the executable format used in Windows?

View solution

Q. Where can you find a full listing of the individual fields of the Portable Executable (PE) format?

View solution

Q. Why is understanding executable formats important for hackers?

View solution

Q. What is the most important thing to bear in mind when dealing with executable files?

View solution

Q. Can an executable file be relocated after it has been loaded?

View solution

Q. Why do executables need to be relocatable?

View solution

Q. Does every program have additional executables loaded into its address space?

View solution

Q. What does the operating system load into each program's address space?

View solution

Q. Why is it likely that two or more modules will try to use the same memory address?

View solution

Q. What is the solution to the problem of multiple modules trying to use the same memory address?

View solution

Q. Why does an executable need to know in advance where it will be loaded?

View solution

Q. What does it mean for an executable file to be relocatable?

View solution

Q. Why does an executable file need to know in advance where it will be loaded?

View solution

Q. What is a relative virtual address (RVA)?

View solution

Q. Why are relocations important for executable files?

View solution