x86 call machine code

Question

I looked up intel's document, it says enter image description here

In the absolute indirect call near, "FF /2" this "/2" means what? 2 bytes or sth else? And I want to know the entire list about "call proc" machince code, for example:

1: e8 xx xx xx xx --> near call relative
2: ff 15 xx xx xx xx --> near call absolute
3: ff 50 xx --> near call by reg

Best Regards!Thanks a lot!

Section 2 of that document describes instruction encodings, including the /digit form. — Sneftel, Mar 31 '15 at 07:36
It means the `/r` field in the ModR/M byte is part of the opcode and must have that value. — Peter Cordes, Apr 27 '18 at 05:38

score -1 · Accepted Answer · answered Apr 10 '15 at 07:26

I use distorm to show the result, write a loop to create machince code like:ff 01 xx xx xx xx - ff ff xx xx xx xx

ff1012344500 (0L, 2L, 'CALL DWORD [EAX]', 'ff10')
ff1112344500 (0L, 2L, 'CALL DWORD [ECX]', 'ff11')
ff1212344500 (0L, 2L, 'CALL DWORD [EDX]', 'ff12')
ff1312344500 (0L, 2L, 'CALL DWORD [EBX]', 'ff13')
ff1412344500 (0L, 3L, 'CALL DWORD [EDX+EDX]', 'ff1412')
ff1512344500 (0L, 6L, 'CALL DWORD [0x453412]', 'ff1512344500')
ff1612344500 (0L, 2L, 'CALL DWORD [ESI]', 'ff16')
ff1712344500 (0L, 2L, 'CALL DWORD [EDI]', 'ff17')

ff5012344500 (0L, 3L, 'CALL DWORD [EAX+0x12]', 'ff5012')
ff5112344500 (0L, 3L, 'CALL DWORD [ECX+0x12]', 'ff5112')
ff5212344500 (0L, 3L, 'CALL DWORD [EDX+0x12]', 'ff5212')
ff5312344500 (0L, 3L, 'CALL DWORD [EBX+0x12]', 'ff5312')
ff5412344500 (0L, 4L, 'CALL DWORD [EDX+EDX+0x34]', 'ff541234')
ff5512344500 (0L, 3L, 'CALL DWORD [EBP+0x12]', 'ff5512')
ff5612344500 (0L, 3L, 'CALL DWORD [ESI+0x12]', 'ff5612')
ff5712344500 (0L, 3L, 'CALL DWORD [EDI+0x12]', 'ff5712')

ff9012344500 (0L, 6L, 'CALL DWORD [EAX+0x453412]', 'ff9012344500')
ff9112344500 (0L, 6L, 'CALL DWORD [ECX+0x453412]', 'ff9112344500')
ff9212344500 (0L, 6L, 'CALL DWORD [EDX+0x453412]', 'ff9212344500')
ff9312344500 (0L, 6L, 'CALL DWORD [EBX+0x453412]', 'ff9312344500')
ff9412344500 (0L, 1L, 'DB 0xff', 'ff')
ff9512344500 (0L, 6L, 'CALL DWORD [EBP+0x453412]', 'ff9512344500')
ff9612344500 (0L, 6L, 'CALL DWORD [ESI+0x453412]', 'ff9612344500')
ff9712344500 (0L, 6L, 'CALL DWORD [EDI+0x453412]', 'ff9712344500')

ffd012344500 (0L, 2L, 'CALL EAX', 'ffd0')
ffd112344500 (0L, 2L, 'CALL ECX', 'ffd1')
ffd212344500 (0L, 2L, 'CALL EDX', 'ffd2')
ffd312344500 (0L, 2L, 'CALL EBX', 'ffd3')
ffd412344500 (0L, 2L, 'CALL ESP', 'ffd4')
ffd512344500 (0L, 2L, 'CALL EBP', 'ffd5')
ffd612344500 (0L, 2L, 'CALL ESI', 'ffd6')
ffd712344500 (0L, 2L, 'CALL EDI', 'ffd7')

result list above is absolute near call, relative near call is e8 xx xx xx xx, in win32 I don't care far call

x86 call machine code

1 Answers1