On Mon, Aug 27, 2012 at 9:15 AM, Sergey Ivanov <icegood1980@xxxxxxxxx> wrote: > So, cmp edx,0x1 is comparsion for Caller.endSign and so on. But from where > call > instruction taked? There are many so "left" calls in my disasm. All of > them have same binary signature "e8 00 00 00 00". You are disassembling an object file. The call address is stored in relocation information and will be filled in by the linker. To see the relocation information along with the disassembly, use objdump -dr. Ian
