What is __i686.get_pc_thunk.bx? Why do we need this call?

Solution 1:

This call is used in position-independent code on x86. It loads the position of the code into the %ebx register, which allows global objects (which have a fixed offset from the code) to be accessed as an offset from that register.

Position-independent code is code that can be loaded and executed, unmodified, at different addresses. It is important for code that will be linked into shared libraries, because these can be mapped at a different address in different processes.

Note that an equivalent call is not required on x86-64, because that architecture has IP-relative addressing modes (that is, it can directly address memory locations as an offset from the location of the current instruction).

Solution 2:

Adding more to the information by example:

Suppose after you do disass on gdb inside function startup, then you will find something like this:

0x012c17a3  <startup+7>:     call   0x12b2ce7 <__i686.get_pc_thunk.bx>
0x012c17a8 <startup+12>:     add    $0x10d6518,%ebx

Then after you have called __i686.get_pc_thunk.bx, register ebx will be populated by value 0x012c17a8, which is the address of next instruction.

You can read the function as get_pc(program counter).

I found this article very nice for better understanding:

https://www.technovelty.org/linux/plt-and-got-the-key-to-code-sharing-and-dynamic-libraries.html