x86函数调用类型 [英] x86 function call types
问题描述
我是x86的新手.我的问题是关于函数调用的.据我所知，有三种函数调用类型:短调用(0xe8)，远调用(0x9a)和近调用(0x ??).有些呼叫短呼叫是相对呼叫(ip + = arg/cs = inv)，远呼叫绝对呼叫(ip = arg/cs = arg)，但是近距离呼叫(ip =?/cs =?)怎么样.有人说，在32位系统上，调用函数far(9a)几乎可以肯定是错误的.为什么? x86不是32位系统吗?是far call的参数是平面地址(我们在c ++或其他语言中使用的地址)还是用cs:ip表示，我如何将纯地址转换为cs:ip形式?还有其他函数调用类型吗?
I'm new in x86. My question is about function calls. As far as i know there is three function call types: short call (0xe8), far call (0x9a) and near call (0x??). Some call short call a relative call (ip += arg / cs = inv) and far call an absolute call (ip = arg / cs = arg), but what about near call (ip = ? / cs = ?). Some say that calling function far (9a) is almost certainly wrong on 32-bit systems. Why? Doesn't x86 mean 32-bit system? Is far call's argument a flat address (the one we use in c++ or other languages) or cs:ip notated and how do i convert a plain address into cs:ip form? Is there other function call types?
推荐答案
CALL指令的类型为:
- 近亲(操作码E8)(
call func) - 绝对远距离(操作码9A)(
call 0x12:0x12345678) - 绝对，间接(操作码FF/2)(
call [edi]) 附近
- 远距离，绝对，间接(操作码FF/3)(
call far [edi])
- Near, relative (opcode E8) (
call func) - Far, absolute (opcode 9A) (
call 0x12:0x12345678) - Near, absolute, indirect (opcode FF /2) (
call [edi]) - Far, absolute, indirect (opcode FF /3) (
call far [edi])
Far调用表示除了eip之外，它还更改了段选择器(cs)的值.临近通话仅更改ip/eip/rip.
Far call means that it changes the value of the segment selector (cs) in addition to eip. Near call changes only ip/eip/rip.
相对"表示地址将相对于下一条指令的地址，而绝对调用给出要跳转到的确切地址.
Relative means that the address will be relative to the address of the next instruction while an absolute call gives the exact address to jump to.
间接调用在寄存器或存储器内容中指定目标地址，而直接调用将在指令中指定目标地址.
An indirect call specifies the target address in a register or memory contents, while in a direct call it will be specified as part of the instruction.
有人说，在32位系统上，调用函数far(9a)几乎可以肯定是错误的.为什么?
Some say that calling function far (9a) is almost certainly wrong on 32-bit systems. Why?
可能是因为通常32位操作系统将使用平面内存模型，在该模型中，可以从同一段访问所有内存(如果允许访问)，因此不需要更改cs的值.
Probably because generally 32-bit operating systems will use a flat memory model where all memory can be accessed from the same segment (if access is permitted), so there is no need to change the value of cs.
Far call还会将CS:EIP而不只是EIP作为返回地址，如果您调用一个期望在返回地址正上方找到堆栈args的普通函数，则会出现问题.
Far call also pushes CS:EIP instead of just EIP as the return address, which is a problem if you call a normal function that's expecting to find stack args right above the return address.
x86不是32位系统吗?
Doesn't x86 mean 32-bit system?
不. x86最初是16位指令集，后来扩展为32位，然后扩展为64位.另请参阅Stack Overflow的 x86标签Wiki
No. x86 was originally a 16-bit instruction set, and was later extended to 32 bits and then 64 bits. See also Stack Overflow's x86 tag wiki
far call的参数是纯地址(我们用c ++或其他语言使用的地址)还是cs:ip表示的，我如何将纯地址转换为cs:ip形式?
Is far call's argument a plain address (the one we use in c++ or other languages) or cs:ip notated and how do i convert a plain address into cs:ip form?
我不知道您所说的普通住址"是什么意思.在具有平面内存模型的32位操作系统上，存储在C ++指针中的地址将不包含段选择器，因此要将其转换为远地址，您需要添加cs的值.
I don't know what you mean by a "plain address". On a 32 bit OS with flat memory model the address stored in a C++ pointer will not include a segment selector, so to convert it to a far address you'd add the value of cs.
但是对于绝对直接形式，在构建时需要正确的cs值.
But for the absolute direct form, you need the right value of cs at built time.
这篇关于x86函数调用类型的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
