%eip

[JANAPA REDDI VIJAY <Vijay.Janapareddi@xxxxxxxxxxxx>]

I realize that in the _fini function the call instruction is executed to 
an instruction immediately following it and the value is immediately poped 
into a register. I am guessing this is done to get the instruction pointer 
since there is no direct way to get the ip on x86?! I have seen this 
behavior even in libc.

I am unsure why this 
is needed to be done the way it is done? I am not able to generalize how 
the call and pop combination is used by the compiler.

Any comments on that are much appreciated. Thank you.

     0x80489a0 <_fini>:      push   %ebp
     0x80489a1 <_fini+1>:    mov    %esp,%ebp
     0x80489a3 <_fini+3>:    push   %ebx
     0x80489a4 <_fini+4>:    push   %edx
***> 0x80489a5 <_fini+5>:    call   0x80489aa <_fini+10>
***> 0x80489aa <_fini+10>:   pop    %ebx
     0x80489ab <_fini+11>:   add    $0x11ce,%ebx
     0x80489b1 <_fini+17>:   nop
     0x80489b2 <_fini+18>:   call   0x8048438 <__do_global_dtors_aux>
     0x80489b7 <_fini+23>:   mov    0xfffffffc(%ebp),%ebx
     0x80489ba <_fini+26>:   leave
     0x80489bb <_fini+27>:   ret


&> veej.