gcc and -fPIC

[bserdar@nc.rr.com]

>  80485b3:       e8 00 00 00 00          call   80485b8 <X::f()+0xc>
>  80485b8:       5b                      pop    %ebx
>  80485b9:       81 c3 5c 12 00 00       add    $0x125c,%ebx

With pop ebx, it pops the eip at that instruction to ebx. I'm guessing it'll use ebx as a base pointer to data (or code?) from this point on. You can verify this guess by accessing some global variables from within X::f() and see whether it uses ebx-relative access.