9

Hoping to get a better explanation of x86 call instruction. I sort of understand the call near and call far. But I don't fully understand the segment part. A little insight into my main problem, I am looking at a binary in IDA and its start code is:

push 0xdeadbeef
call near 0xdeadbeef
  • 2
    This is very 1337 code, if it has deadbeef in it ;) – 0xC0000022L May 3 '13 at 18:46
11

99% of the calls you'll encounter in modern binaries are near.

  • call near (with opcode E8) is a call relative to the current address, and only affects ?IP. Thus it will add the operand (word or double word) to the next instruction pointer. it's adding the operand to ?IP
  • call far (with opcode 9A) jumps to an absolute segment and offset. ie, it's like setting CS and ?IP at once.

The memory is actually organized in segments. In modern OSes, you usually don't mess with segments (CS has a fixed value in User mode and Kernel mode), so you don't change them for any reason.

The rare cases of actual segment changes are as anti-debugs or messing with 32/64b modes

| improve this answer | |
  • Isn't it related with the setjmp/lngjmp C functions (see this tutorial) ? – perror May 3 '13 at 16:45
  • @perror: AFAIK not directly. – 0xC0000022L May 3 '13 at 18:45
  • 1
    no, "long" in the sense of "longjmp" has nothing to do with far jump. – peter ferrie May 5 '13 at 2:25
6

A segment is a "window" into a section of memory. You can map all or part of memory into a single segment, and multiple segments can have overlapping views of the same memory. A far call or jump allows you to move between or within those windows. A near call or jump allows you to move only within the current window.

The only difference between the call and the jump is that the call saves the return address on the stack. For a far call, the return selector is saved on the stack, too.

However, your question lacks sufficient detail of what exactly you want to know.

| improve this answer | |
  • how does the call memory segment specified in the opcode e.g. E8 D2 12 00 00 call sub_402390 how does 000012D2 relate to 402390? That's where I'm lost. – the_endian Apr 5 '17 at 23:47
  • 1
    the 12D2 is added to the memory address immediately after the end of the instruction, so the call instruction ends at 4010BE + 12D2 = 402390. – peter ferrie Apr 11 '17 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.