Generating operands of a CALL instruction on x86-64 AMD

Question

Below is the result of objdump sample program,

080483b4 <display>: 80483b4: 55 push %ebp 80483b5: 89 e5 mov %esp,%ebp 80483b7: 83 ec 18 sub $0x18,%esp 80483ba: 8b 45 0c mov 0xc(%ebp),%eax 80483bd: 89 44 24 04 mov %eax,0x4(%esp) 80483c1: 8d 45 fe lea 0xfffffffe(%ebp),%eax 80483c4: 89 04 24 mov %eax,(%esp) 80483c7: e8 ec fe ff ff call 80482b8 < strcpy@plt > 80483cc: 8b 45 08 mov 0x8(%ebp),%eax 80483cf: 89 44 24 04 mov %eax,0x4(%esp) 80483d3: c7 04 24 f0 84 04 08 movl $0x80484f0,(%esp) 80483da: e8 e9 fe ff ff call 80482c8 < printf@plt > 80483df: c9 leave 80483e0: c3 ret 080483e1 <main>: 80483e1: 8d 4c 24 04 lea 0x4(%esp),%ecx 80483e5: 83 e4 f0 and $0xfffffff0,%esp 80483e8: ff 71 fc pushl 0xfffffffc(%ecx) 80483eb: 55 push %ebp 80483ec: 89 e5 mov %esp,%ebp 80483ee: 51 push %ecx 80483ef: 83 ec 24 sub $0x24,%esp 80483f2: c7 44 24 04 f3 84 04 movl $0x80484f3,0x4(%esp) 80483f9: 08 80483fa: c7 04 24 0a 00 00 00 movl $0xa,(%esp) 8048401: e8 ae ff ff ff call 80483b4 <display> 8048406: b8 00 00 00 00 mov $0x0,%eax 804840b: 83 c4 24 add $0x24,%esp 804840e: 59 pop %ecx 804840f: 5d pop %ebp 8048410: 8d 61 fc lea 0xfffffffc(%ecx),%esp 

What I need to understand, basically we see the following at the address - 8048401, we call 80483b4, however the machine code is e8 ae ff ff ff. I see that the CALL instruction is E8, but how will the address of the function 80483b4 be decoded by FFFFFFAE? I searched a lot on google but returned nothing. Can anyone explain?

Answer 1

E8 is the operand for Relative Call, that is, the destination address is calculated by adding the operand to the address of the next instruction. Operand 0xFFFFFFAE, negative 0x52. 0x808406 - 0x52 - 0x80483b4.

Most disassemblers usefully calculate the actual address of the target, rather than just giving you the relative address in the operand.

Complete information for the x86 ISA at: http://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-vol-2a-manual. html

Answer 2

Interest Ask. I looked at the Intel documentation and the CALL rel16/32 E8 CALL rel16/32 . 0xffffffae is actually a 32-bit two-digit integer equal to -82 decimal; this is the relative address from the byte immediately after the operation code and its operands.

If you do the math, you will see that it checks:

0x8048406 - 82 = 0x80483b4

This places the instruction pointer at the beginning of the display function.

Answer 3

Close calls usually refer to an IP address, which means that the “address” is actually an offset from the instruction pointer. In this case, EIP points to the next command (therefore, its value is 8048406 ). Add ffffffae (or -00000052 in two additions) to it and you will get 80483b4 .

Note that all this math is 32-bit. Here you do not perform any 64-bit operations (or your registers will have R instead of E in their names, and the addresses will be much longer).