Better explanation of different x86 CALL variations

Question

Hoping to get a better explanation of x86 call instruction. I sort of understand the call near and call far. But I don't fully understand the segment part. A little insight into my main problem, I am looking at a binary in IDA and its start code is:

push 0xdeadbeef
call near 0xdeadbeef

This is very 1337 code, if it has deadbeef in it ;) – 0xC0000022L May 03 '13 at 18:46 — 0xC0000022L, May 03 '13 at 18:46

Ange · Answer 1 · 2013-05-03T16:18:59.710

13

99% of the calls you'll encounter in modern binaries are near.

call near (with opcode E8) is a call relative to the current address, and only affects ?IP. Thus it will add the operand (word or double word) to the next instruction pointer. it's adding the operand to ?IP
call far (with opcode 9A) jumps to an absolute segment and offset. ie, it's like setting CS and ?IP at once.

The memory is actually organized in segments. In modern OSes, you usually don't mess with segments (CS has a fixed value in User mode and Kernel mode), so you don't change them for any reason.

The rare cases of actual segment changes are as anti-debugs or messing with 32/64b modes

edited May 03 '13 at 16:18

answered May 03 '13 at 16:12

Ange

6,694
3
28
62

Isn't it related with the setjmp/lngjmp C functions (see this tutorial) ? – perror May 03 '13 at 16:45
@perror: AFAIK not directly. – 0xC0000022L May 03 '13 at 18:45
1

no, "long" in the sense of "longjmp" has nothing to do with far jump. – peter ferrie May 05 '13 at 02:25

score 7 · Answer 2 · answered May 05 '13 at 03:10

7

A segment is a "window" into a section of memory. You can map all or part of memory into a single segment, and multiple segments can have overlapping views of the same memory. A far call or jump allows you to move between or within those windows. A near call or jump allows you to move only within the current window.

The only difference between the call and the jump is that the call saves the return address on the stack. For a far call, the return selector is saved on the stack, too.

However, your question lacks sufficient detail of what exactly you want to know.

answered May 05 '13 at 03:10

peter ferrie

4,709
4
19
33

how does the call memory segment specified in the opcode e.g. E8 D2 12 00 00 call sub_402390 how does 000012D2 relate to 402390? That's where I'm lost. – the_endian Apr 05 '17 at 23:47
1

the 12D2 is added to the memory address immediately after the end of the instruction, so the call instruction ends at 4010BE + 12D2 = 402390. – peter ferrie Apr 11 '17 at 18:18

Better explanation of different x86 CALL variations

2 Answers2