Differencing the instruction of the same opcode

Question

I am coding a ftrace program on Linux(64 bits) for study purpose, and I need to parse the instruction using ptrace() syscall.

The instruction I am interested in are ret and call. The call instruction may take different opcodes (0xe8, 0x9a and 0xff). This is the last one that questions me: this 0xff can also stand for inc, dec, jmp and push instruction, but I read that the "register / opcode field" changes.

My question is: How can I have the information that call is called and not dec or inc? I have access to the opcodes and the registers.

Thank you for reading and helping me.

Answer 1

You can tell the difference by looking at 3-bit field (bits 5,4,3) in the next instruction byte.

000     inc instruction

001     dec instruction

010     intra-segment indirect call

011     inter-segment indirect call

100     intra-segment indirect jump

101     inter-segment indirect jump

110     push instruction

111     unused