6

In windows PE files (32 and 64 bit) calls to imported functions look like this in IDA PRO:

call    ds:SetEvent              // default setting
call    [ds:SetEvent]            // Target Assembler set to TASM

I understand what it does (indirect call, import table, ...) but what I do not understand: Why is IDA adding the ds: in front of the function name? I checked the opcode, it is FF 15 meaning a near call.

If I am right to assume that the ds is a segment register, there is no need to specify it as a near call means a call of a function inside the same segment.

Could someone explain why IDA is adding the ds: anyway and what it is good for?

langlauf.io
  • 1,560
  • 1
  • 19
  • 36

1 Answers1

9

The FF 15 is an absolute indirect call. It is fetching the value at a memory location, and then transferring control to the fetched address.

In order to specify that memory location precisely, the CPU needs both the segment register and the address. In the absence of an explicit request (2E for CS, for example), or a mode which has an implicit override (use of EBP selects SS:), DS: is used. Despite Windows using a flat memory model, nothing prevents the segment registers from having other values assigned to them: 32-bit Windows supports Local Descriptor Table entries, for example, and there are tricks where DS: is given the value of FS:, to perform non-obvious SEH registration.

IDA displays the segment register to remove any ambiguity as to which segment register is in use.

peter ferrie
  • 4,709
  • 4
  • 19
  • 33
  • you write: "In order to specify that memory location precisely, the CPU needs both the segment register and the address."

    I thought a near call does not need any segment information. I thought a near call was "a call of a function inside the same segment". Am I missing something?

     – langlauf.io Apr 24 '15 at 17:37
  • 1
    Perhaps "In order to specify the location from which to fetch", then? "near" in this sense refers to the return address, not the location from which it is fetched. A near call has only the return address placed on the stack. A far call has both selector and return address placed on the stack. – peter ferrie Apr 24 '15 at 18:27
  • Got it now. Thanks for the additional clarification. – langlauf.io Apr 24 '15 at 20:16