Question

What is the weakness in Defender's technique of obfuscating API calls?

a.

The implementation maintains the APIs order from the export table

b.

It is not possible to retrieve the API name from its checksum

c.

It is possible to directly step into the kernel in a kernel debugger to find out which API is being called

d.

Randomly reorganizing the table during initialization

Posted under Reverse Engineering

Answer: (c).It is possible to directly step into the kernel in a kernel debugger to find out which API is being called Explanation:For some APIs, it is possible to just directly step into the kernel in a kernel debugger and find out which API is being called.

Engage with the Community - Add Your Comment

Confused About the Answer? Ask for Details Here.

Know the Explanation? Add it Here.

Q. What is the weakness in Defender's technique of obfuscating API calls?

Add Comment

Similar Questions

Discover Related MCQs

Q. What was the purpose of adding the call to IsDebuggerPresent API in Defender?

View solution

Q. What is the impact of obfuscating the interface with the operating system?

View solution

Q. What is the purpose of the Processor Time-Stamp Verification Thread in Defender?

View solution

Q. Why is it important to directly access the hardware time-stamp counter using a low-level instruction in the Processor Time-Stamp Verification Thread?

View solution

Q. What would happen if the encryption on each key function was not implemented in the Processor Time-Stamp Verification Thread?

View solution

Q. What modifications can be made to a time-stamp verification thread to make it more difficult to remove?

View solution

Q. Is the current implementation of the verification thread safe for commercial use?

View solution

Q. What changes should be made to the counter constant in a commercial product environment?

View solution

Q. What priority should the verification thread be set to in a commercial product environment?

View solution

Q. What is the purpose of adding periodical checksum calculations from the main thread?

View solution

Q. Why should the actual checksum verifications be inlined?

View solution

Q. What should be done with the verification thread in a commercial product environment?

View solution

Q. What is the advantage of generating decryption keys in runtime?

View solution

Q. What are interdependent keys?

View solution

Q. How does Defender use interdependent keys?

View solution

Q. What is a cryptographic hash algorithm?

View solution

Q. How does Defender generate decryption keys?

View solution

Q. What is the purpose of dongle protection?

View solution

Q. Why was the Chained Block Cipher in Defender crackable?

View solution

Q. What would make cracking Defender more difficult?

View solution

View All MCQs on Reverse Engineering

Suggested Topics

Are you eager to expand your knowledge beyond Reverse Engineering? We've curated a selection of related categories that you might find intriguing.

Click on the categories below to discover a wealth of MCQs and enrich your understanding of Computer Science. Happy exploring!

HTML

Start your journey in web development with our HTML MCQs. Learn the building blocks...

Wireless and Mobile Communications

Get to grips with modern communication technologies with our Wireless and Mobile...

Java Programming

Level up your coding skills with our Java Programming MCQs. From object-oriented...

IT Fundamentals

Navigate the basics of information technology with our IT Fundamentals MCQs. Get a...

Software Engineering

Learn about the systematic approach to developing software with our Software...

PHP

Venture into server-side scripting with our PHP MCQs. Cover everything from syntax...

UNIX

Become proficient with the Unix operating system using our UNIX MCQs. Learn about...

CSS

Polish your web design skills with our CSS MCQs. Learn about selectors, properties,...

MATLAB

Hone your computational mathematics skills with our MATLAB MCQs. Understand...