Designing BSD Rootkits

Understanding x86 Call Statements

In x86 assembly the call statement is a control transfer instruction used to call a function or procedure. There are two types of call statements: near and far. For our purposes, we only need to understand near call statements. The following (contrived) code segment illustrates the details of a near call.

 200:   bb 12 95 00 00          mov    $0x9512,%ebx
 205:   e8 f6 00 00 00          call   300
 20a:   b8 2f 14 00 00          mov    $0x142f,%eax

In the above code snippet, when the instruction pointer reaches address 205—the call statement—it will jump to address 300. The hexadecimal representation for a call statement is e8. However, f6 00 00 00 is obviously not 300. At first glance, it appears that the machine code and assembly code don't match, but ...