Better explanation of different x86 CALL variations

Question

Hoping to get a better explanation of x86 call instruction. I sort of understand the call near and call far. But I don't fully understand the segment part. A little insight into my main problem, I am looking at a binary in IDA and its start code is:

push 0xdeadbeef
call near 0xdeadbeef

Answer 1

99% of the calls you'll encounter in modern binaries are near.

• call near (with opcode E8) is a call relative to the current address, and only affects ?IP. Thus it will add the operand (word or double word) to the next instruction pointer. it's adding the operand to ?IP
• call far (with opcode 9A) jumps to an absolute segment and offset. ie, it's like setting CS and ?IP at once.

The memory is actually organized in segments. In modern OSes, you usually don't mess with segments (CS has a fixed value in User mode and Kernel mode), so you don't change them for any reason.

The rare cases of actual segment changes are as anti-debugs or messing with 32/64b modes

Answer 2

A segment is a "window" into a section of memory. You can map all or part of memory into a single segment, and multiple segments can have overlapping views of the same memory. A far call or jump allows you to move between or within those windows. A near call or jump allows you to move only within the current window.

The only difference between the call and the jump is that the call saves the return address on the stack. For a far call, the return selector is saved on the stack, too.

However, your question lacks sufficient detail of what exactly you want to know.