CODEWITHSUNDEEP
cassemblyx86
Austin
Austin

Reputation: 33

How does CALL instruction parsed into hex?

I have written a simple C code is like:

int add2(int a) {
  return a+2;
}

int main()
{
  int a=0;
  a = add2(a);
  printf("%d\n", a);
}

and when I use objdump I found this:

  400558:       e8 d8 ff ff ff          callq  400535 <add2>

I'm wondering the relationship between the hex code e8 d8 ff ff ff and callq 400535 <add2>. I searched and found the hex code of callq is e8, but what about d8 ff ff ff? does it has some relationship with the address that callq calls? Thank you very much.

Upvotes: 2

Views: 2224

Answers (1)

Govind Parmar
Govind Parmar

Reputation: 21552

If you look at this instruction reference, you will see that the opcode E8 for call has two possible operands, rel16 and rel32, which mean a relative address displacement of either 16 or 32-bits from the next instruction pointer. The d8 ff ff ff is, when interpreted as a 32-bit two's complement value stored in little-endian, the relative displacement 0xFFFFFFD8, which is -40, so the call instruction is calling the code that begins -40 bytes before the end of the call instruction itself as a function.

Upvotes: 8

Related Questions