So recently I’ve been wanting to call some win32 calls from assembly, and I’ve been using NASM as my external assembler. I was calling SendMessage in my code in the following way:
call __imp__SendMessageW@16
This was assembled into a relative jump (0xE8 opcode) and the result was an access violation. In the debugger, the computed jump offset seemed to be the correct one (in that __imp__SendMessageW@16 really did seem to reside there) but nonetheless it did not work. Examining the assembly produced by Visual Studio when I called the function from C++, I noticed that it wasn’t a relative immediate jump it was using, but instead (in the language of MASM) a call dword ptr [__imp__SendMessageW@16], corresponding to an 0xFF15 opcode. After some futzing around I figured out that NASM syntax encodes this as call dword near [dword __imp__SendMessageW@16], and making the change my code suddenly worked.
My question is, why does one work and not the other? Is there some relocation of code going on that causes the relative immediate call to jump somewhere unfriendly? I’ve never been much of an assembly programmer but my impression was always that the two calls should do the same thing and the main difference is that one is position independent and the other is not (assuming that they move the IP to the same place). The relocation of code theory makes sense given that, but then how do you explain the debugger showing the right address?
Also: what’s the logic behind the [] syntax in this call? The offset is still an immediate (just little endian encoded immediately after 0xFF15), there’s no memory access going on here beyond the instruction fetch (I tend to think of [] as a dereference outside the context of lea).
_imp_SendMessageW@16 is an address to your imports section that contains the address of the API function. You use the square brackets to deference (call the address STORED by this address)