geteip:
pop %ebx

那么 geteip(%ebx) 的值是%ebx的值吗？

我还真的看不懂楼主用的语言
楼主用的是什么编译器？

噢！原来是AT&T

FS:[30]是PEB    进程环境块
struct  _PEB (sizeof=488)
+000 byte    InheritedAddressSpace
+001 byte    ReadImageFileExecOptions
+002 byte    BeingDebugged                  //Debug运行标志
+003 byte    SpareBool
+004 void    *Mutant
+008 void    *ImageBaseAddress              //这里就是程序加载的基地址了
+00c struct  _PEB_LDR_DATA *Ldr
+010 struct  _RTL_USER_PROCESS_PARAMETERS *ProcessParameters
+014 void    *SubSystemData
+018 void    *ProcessHeap
+01c void    *FastPebLock
+020 void    *FastPebLockRoutine
+024 void    *FastPebUnlockRoutine
+028 uint32  EnvironmentUpdateCount
+02c void    *KernelCallbackTable
+030 uint32  SystemReserved[2]
+038 struct  _PEB_FREE_BLOCK *FreeList
+03c uint32  TlsExpansionCounter
+040 void    *TlsBitmap
+044 uint32  TlsBitmapBits[2]
+04c void    *ReadOnlySharedMemoryBase
+050 void    *ReadOnlySharedMemoryHeap
+054 void    **ReadOnlyStaticServerData
+058 void    *AnsiCodePageData
+05c void    *OemCodePageData
+060 void    *UnicodeCaseTableData
+064 uint32  NumberOfProcessors
+068 uint32  NtGlobalFlag
+070 union    _LARGE_INTEGER CriticalSectionTimeout
+070    uint32  LowPart
+074    int32    HighPart
+070    struct  __unnamed3 u
+070      uint32  LowPart
+074      int32    HighPart
+070    int64    QuadPart
+078 uint32  HeapSegmentReserve
+07c uint32  HeapSegmentCommit
+080 uint32  HeapDeCommitTotalFreeThreshold
+084 uint32  HeapDeCommitFreeBlockThreshold
+088 uint32  NumberOfHeaps
+08c uint32  MaximumNumberOfHeaps
+090 void    **ProcessHeaps
+094 void    *GdiSharedHandleTable
+098 void    *ProcessStarterHelper
+09c uint32  GdiDCAttributeList
+0a0 void    *LoaderLock
+0a4 uint32  OSMajorVersion
+0a8 uint32  OSMinorVersion
+0ac uint16  OSBuildNumber
+0ae uint16  OSCSDVersion
+0b0 uint32  OSPlatformId
+0b4 uint32  ImageSubsystem
+0b8 uint32  ImageSubsystemMajorVersion
+0bc uint32  ImageSubsystemMinorVersion
+0c0 uint32  ImageProcessAffinityMask
+0c4 uint32  GdiHandleBuffer[34]
+14c function *PostProcessInitRoutine
+150 void    *TlsExpansionBitmap
+154 uint32  TlsExpansionBitmapBits[32]
+1d4 uint32  SessionId
+1d8 void    *AppCompatInfo
+1dc struct  _UNICODE_STRING CSDVersion
+1dc    uint16  Length
+1de    uint16  MaximumLength
+1e0    uint16  *Buffer