title: What is this pattern where the EBX register is used for memory access?
body: <p>I'm learning the basis of reverse engineering. While reversing a crackme it happened to me to see this pattern at the beginning of almost every function:</p>
  
  <pre><code>pushl %ebp                            
  movl  %esp, %ebp              
  pushl %ebx              # because ebx is a callee-saved register
  subl  $0x14,%esp        # of course $0x14 changes depending on the function
  calll 0x08048766
  addl  $0x1a5f, %ebx     # also this value sometime changes depending on the function
  </code></pre>
  
  <p>Where at <code>0x08048766</code> there is a function that does just this:</p>
  
  <pre><code>movl 0(%esp), %ebx         
  retl 
  </code></pre>
  
  <p>So basically, as it is normal, every function first initialize the registers <code>ebp</code> and <code>esp</code>. Then the register <code>ebx</code> is pushed into the stack, and this also is totally understandable as <code>ebx</code> is a callee-saved register and it is used later in the function to reference some static data (from <code>.rodata</code>), for example:</p>
  
  <pre><code>leal  -0x17b7(%ebx), %eax
  movl  %eax, 0(%esp) 
  calll printf   
  </code></pre>
  
  <p>Now the most interesting (and to me obscure) part: If I have understood correctly, <code>ebx</code> is first initialized with the value pointed by <code>esp</code> (this using the function at <code>0x08048766</code>), why? What's inside there? Isn't it an uninitialized point down into the stack?</p>
  
  <p>Then another value is added to <code>ebx</code>. What does this value represent?</p>
  
  <p>I would like to understand better how the register <code>ebx</code> is used in this case, and how to calculate the address it is pointing to.</p>
  
  <p>You can have a look to the complete program <a href="https://github.com/Maijin/Workshop2015/blob/master/IOLI-crackme/bin-linux/crackme0x09" rel="nofollow">here</a>, but unfortunately  there isn't any C source code available.</p>