I think the below instruction is used for position independent code. Could anyone please help me understand how it works?

call 135b<__x86.get_pc_thunk.ax>

What are the use of the below instructions after it returns?

add    eax,0x2d77
mov    edx,DWORD PTR [eax-0xc]
mov    edx,DWORD PTR [edx]

Is it possible to remove call 135b<__x86.get_pc_thunk.ax> from the assembly when compiling the code using GCC?

Thank you.

enter image description here

1 Answer 1


the call is getting the next instructions address in eax
notice the ax
there are other variants of this call with bx,cx,dx at the end
which respectively returns the next instruction address in ebx,ecx and edx

the call at 135b will look like

mov eax,[esp] 

so eax in your specific case will contain 0x1289
after the addition eax will contain 0x4000
so edx will get what is stored at [3ff4]

this is called dereferencing pointers **foo

basically eax will contain the buffer where fscanf stores the return
edx will contain the format string
ecx will contain the FILE*

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.