I am currently analysing a regular Windows x86 executable (-> protected mode) and I came across several far call instructions in the disassembly. I know that far calls, for example, are used in WOW64 to switch from 32bit to 64bit mode (by a far call to code segment 0x33, see here). However, I can not make any sense of the far calls in that executable. They look like this:
<somewhere near 0x00123400>: 9a 34 12 cd ab 34 12 call 0x1234:0xabcd1234
The code segemt is in most cases the same as the lower 16 bits of the call address. At the same time, the code segment is rougly the same as the middle (!) 16 bits of the instruction's own address (as illustrated above). The call addresses always point to unmapped/invalid memory areas in the code segment of the process itself.
How can I identify the call target of these far calls? Is it even possible/pratical to have hard coded code segments? Or could it be an alignment issue of the disassembler?
Edit: For example, the first far call in the image occurs in a chunk of code starting at a 16-byte boundary (identified by leading int3 instructions). The far call comes 2 bytes after the (only) return instruction in that chunk (some 2000 bytes after its start). The offset of the far call instruction is used as an indirect jump offfset like this:
jmp DWORD PTR [eax*4+<far call offset>]