1

I'm doing dynamic binary analysis in Linux. Given the program is dynamically linked (load time linking) and no address space randomization I've to resolve the function name if a standard library function is being called. I saw in disassembled code that, call to standard library routines first branches to some address in .plt section where PC is being loaded with memory address computed there. BTW it is in ARM Linux, but general idea will be same I guess.

I'm new in system programming. I don't know that much about how libraries are linked and addresses are resolved at runtime. Any idea from experts appreciated.

sheikh
  • 117
  • 4
  • 13

1 Answers1

3

The PLT stands for Procedure Linkage Table, the table which resolves functions (and global vars) in shared libraries to addresses in your program.

The PLT is strongly tied to the GOT, the Global Offset Table. Together they perform lazy binding if a address in a shared library is called: At the first call, the actual address of the function is resolved (which may be different from each execution even without address randomization, this depends on the order in which libraries are loaded/used), in further calls the address is indirectly used with the GOT.

You can use tools like objdump and readelf to examine the contents of elf files. Some more detailed explanation is here:

http://www.technovelty.org/linux/pltgot.html

http://timetobleed.com/dynamic-linking-elf-vs-mach-o/

Gunther Piez
  • 29,760
  • 6
  • 71
  • 103