跟踪汇编程序遇CALL用FF15而非EA？2E前缀含义求解

Great question—let’s break this down step by step, since it gets into two key aspects of x86 assembly: different forms of the CALL instruction and segment override prefixes.

Why FF15 instead of EA? #

The CALL instruction isn’t limited to just one opcode—it has multiple addressing modes tailored to different use cases:

• EA is the opcode for a direct far call: it hardcodes the target segment and offset directly into the instruction itself (e.g., EA 00100000 0040 to call the address 0040:00100000). This works for static targets where you know the exact address at compile time.
• FF15 is the opcode for an indirect call via memory: instead of encoding the target address directly, it tells the CPU to read the actual call target from a specific memory location, then jump to that address.

In your case, you’re calling KERNEL32.GetPrivateProfileIntA—a Windows API. Since Windows APIs are dynamically linked, their real memory addresses aren’t known when the program is compiled; they’re resolved when the program loads into memory. The <&KERNEL32.GetPrivateProfileIntA> is a placeholder for a memory location (in the CS segment) that stores the resolved address of the API at runtime. Using FF15 lets the CPU fetch that dynamic address and call it, which is critical for working with shared libraries like kernel32.dll.

What does the 2E prefix do? #

The 2E byte is a segment override prefix. Specifically, it forces the CPU to use the CS (Code Segment) register as the base for the following memory access, instead of the default segment register (which would be DS for most data-related operations).

Here, the operand CS:[<&...>] explicitly specifies the CS segment, and the 2E prefix enforces this behavior. This is necessary because the pointer to the API’s resolved address is stored in the code segment (rather than the data segment) in this executable. Without the prefix, the CPU would try to use DS to resolve the address, which would point to the wrong memory region and likely cause a crash or invalid operation.

内容的提问来源于stack exchange，提问作者Farshid