Mixing
How does CALL instruction parsed into hex?
I have written a simple C code is like:
int add2(int a) {
return a+2;
}
int main()
{
int a=0;
a = add2(a);
printf("%dn", a);
}
and when I use objdump I found this:
400558: e8 d8 ff ff ff callq 400535 <add2>
I'm wondering the relationship between the hex code e8 d8 ff ff ff and callq 400535 <add2>. I searched and found the hex code of callq is e8, but what about d8 ff ff ff? does it has some relationship with the address that callq calls? Thank you very much.
c assembly x86
asked Nov 20 '18 at 14:57
AustinAustin
132
add a comment |
I have written a simple C code is like:
int add2(int a) {
return a+2;
}
int main()
{
int a=0;
a = add2(a);
printf("%dn", a);
}
and when I use objdump I found this:
400558: e8 d8 ff ff ff callq 400535 <add2>
I'm wondering the relationship between the hex code e8 d8 ff ff ff and callq 400535 <add2>. I searched and found the hex code of callq is e8, but what about d8 ff ff ff? does it has some relationship with the address that callq calls? Thank you very much.
c assembly x86
asked Nov 20 '18 at 14:57
AustinAustin
132
There are many resources about x86 assembly all over the Internet. Look up thecallqinstruction and what it operands might mean.
– Some programmer dude
Nov 20 '18 at 15:00
3
0x400558 + sizeof(callq instruction) + 0xffffffd8equals0x400535when truncated to 32 bits.
– Michael
Nov 20 '18 at 15:02
1
As a hint, I recommend you learn about two's complement representation of negative numbers, as well as endianness (especially little endianness).
– Some programmer dude
Nov 20 '18 at 15:02
add a comment |
I have written a simple C code is like:
int add2(int a) {
return a+2;
}
int main()
{
int a=0;
a = add2(a);
printf("%dn", a);
}
and when I use objdump I found this:
400558: e8 d8 ff ff ff callq 400535 <add2>
I'm wondering the relationship between the hex code e8 d8 ff ff ff and callq 400535 <add2>. I searched and found the hex code of callq is e8, but what about d8 ff ff ff? does it has some relationship with the address that callq calls? Thank you very much.
c assembly x86
asked Nov 20 '18 at 14:57
AustinAustin
132
I have written a simple C code is like:
int add2(int a) {
return a+2;
}
int main()
{
int a=0;
a = add2(a);
printf("%dn", a);
}
and when I use objdump I found this:
400558: e8 d8 ff ff ff callq 400535 <add2>
I'm wondering the relationship between the hex code e8 d8 ff ff ff and callq 400535 <add2>. I searched and found the hex code of callq is e8, but what about d8 ff ff ff? does it has some relationship with the address that callq calls? Thank you very much.
c assembly x86
c assembly x86
asked Nov 20 '18 at 14:57
AustinAustin
132
asked Nov 20 '18 at 14:57
AustinAustin
132
asked Nov 20 '18 at 14:57
AustinAustin
132
asked Nov 20 '18 at 14:57
AustinAustin
132
asked Nov 20 '18 at 14:57
AustinAustin
132
132
There are many resources about x86 assembly all over the Internet. Look up thecallqinstruction and what it operands might mean.
– Some programmer dude
Nov 20 '18 at 15:00
3
0x400558 + sizeof(callq instruction) + 0xffffffd8equals0x400535when truncated to 32 bits.
– Michael
Nov 20 '18 at 15:02
1
As a hint, I recommend you learn about two's complement representation of negative numbers, as well as endianness (especially little endianness).
– Some programmer dude
Nov 20 '18 at 15:02
add a comment |
There are many resources about x86 assembly all over the Internet. Look up thecallqinstruction and what it operands might mean.
– Some programmer dude
Nov 20 '18 at 15:00
3
0x400558 + sizeof(callq instruction) + 0xffffffd8equals0x400535when truncated to 32 bits.
– Michael
Nov 20 '18 at 15:02
1
As a hint, I recommend you learn about two's complement representation of negative numbers, as well as endianness (especially little endianness).
– Some programmer dude
Nov 20 '18 at 15:02
There are many resources about x86 assembly all over the Internet. Look up the
callq instruction and what it operands might mean.– Some programmer dude
Nov 20 '18 at 15:00
There are many resources about x86 assembly all over the Internet. Look up the
callq instruction and what it operands might mean.– Some programmer dude
Nov 20 '18 at 15:00
3
3
0x400558 + sizeof(callq instruction) + 0xffffffd8 equals 0x400535 when truncated to 32 bits.– Michael
Nov 20 '18 at 15:02
0x400558 + sizeof(callq instruction) + 0xffffffd8 equals 0x400535 when truncated to 32 bits.– Michael
Nov 20 '18 at 15:02
1
1
As a hint, I recommend you learn about two's complement representation of negative numbers, as well as endianness (especially little endianness).
– Some programmer dude
Nov 20 '18 at 15:02
As a hint, I recommend you learn about two's complement representation of negative numbers, as well as endianness (especially little endianness).
– Some programmer dude
Nov 20 '18 at 15:02
add a comment |
1 Answer
1
active
oldest
votes
If you look at this instruction reference, you will see that the opcode E8 for call has two possible operands, rel16 and rel32, which mean a relative address displacement of either 16 or 32-bits from the next instruction pointer. The d8 ff ff ff is, when interpreted as a 32-bit two's complement value stored in little-endian, the relative displacement 0xFFFFFFD8, which is -40, so the call instruction is calling the code that begins -40 bytes before the end of the call instruction itself as a function.
answered Nov 20 '18 at 15:03
Govind ParmarGovind Parmar
7,72053155
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53395740%2fhow-does-call-instruction-parsed-into-hex%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
If you look at this instruction reference, you will see that the opcode E8 for call has two possible operands, rel16 and rel32, which mean a relative address displacement of either 16 or 32-bits from the next instruction pointer. The d8 ff ff ff is, when interpreted as a 32-bit two's complement value stored in little-endian, the relative displacement 0xFFFFFFD8, which is -40, so the call instruction is calling the code that begins -40 bytes before the end of the call instruction itself as a function.
answered Nov 20 '18 at 15:03
Govind ParmarGovind Parmar
7,72053155
add a comment |
If you look at this instruction reference, you will see that the opcode E8 for call has two possible operands, rel16 and rel32, which mean a relative address displacement of either 16 or 32-bits from the next instruction pointer. The d8 ff ff ff is, when interpreted as a 32-bit two's complement value stored in little-endian, the relative displacement 0xFFFFFFD8, which is -40, so the call instruction is calling the code that begins -40 bytes before the end of the call instruction itself as a function.
answered Nov 20 '18 at 15:03
Govind ParmarGovind Parmar
7,72053155
add a comment |
If you look at this instruction reference, you will see that the opcode E8 for call has two possible operands, rel16 and rel32, which mean a relative address displacement of either 16 or 32-bits from the next instruction pointer. The d8 ff ff ff is, when interpreted as a 32-bit two's complement value stored in little-endian, the relative displacement 0xFFFFFFD8, which is -40, so the call instruction is calling the code that begins -40 bytes before the end of the call instruction itself as a function.
answered Nov 20 '18 at 15:03
Govind ParmarGovind Parmar
7,72053155
If you look at this instruction reference, you will see that the opcode E8 for call has two possible operands, rel16 and rel32, which mean a relative address displacement of either 16 or 32-bits from the next instruction pointer. The d8 ff ff ff is, when interpreted as a 32-bit two's complement value stored in little-endian, the relative displacement 0xFFFFFFD8, which is -40, so the call instruction is calling the code that begins -40 bytes before the end of the call instruction itself as a function.
answered Nov 20 '18 at 15:03
Govind ParmarGovind Parmar
7,72053155
answered Nov 20 '18 at 15:03
Govind ParmarGovind Parmar
7,72053155
answered Nov 20 '18 at 15:03
Govind ParmarGovind Parmar
7,72053155
answered Nov 20 '18 at 15:03
Govind ParmarGovind Parmar
7,72053155
7,72053155
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53395740%2fhow-does-call-instruction-parsed-into-hex%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
There are many resources about x86 assembly all over the Internet. Look up the
callqinstruction and what it operands might mean.– Some programmer dude
Nov 20 '18 at 15:00
3
0x400558 + sizeof(callq instruction) + 0xffffffd8equals0x400535when truncated to 32 bits.– Michael
Nov 20 '18 at 15:02
1
As a hint, I recommend you learn about two's complement representation of negative numbers, as well as endianness (especially little endianness).
– Some programmer dude
Nov 20 '18 at 15:02