title: Get the value of EIP with x86 assembly
body: <p>The accepted answer of <a href="https://stackoverflow.com/questions/4062403/how-to-check-the-eip-value-with-assembly-language">this StackOverflow post</a> gives the following solution:</p>
  
  <pre><code>get_eip: mov eax, [esp]
           ret
  </code></pre>
  
  <p>But I don't understand why this works. Why is the saved <code>EIP</code> pointed to by <code>ESP</code>? Shouldn't <code>ESP</code> be pointing to <code>SFP</code> (the old <code>EBP</code> value) at the time we execute the <code>mov</code> instruction? The prologue of a subroutine call in x86 assembly looks like:</p>
  
  <pre><code>push ebp      ; Save the old base pointer value
  mov ebp, esp  ; Set the new base pointer value
  sub esp, ...  ; Make room for local variable
  </code></pre>
  
  <p>So shouldn't the saved <code>EIP</code> sit one more word above the address where <code>ESP</code> is pointing to?</p>