Global Offset Table (GOT-PLT)
- •
What it is
- •
The PLT contains call stubs; the GOT holds addresses used to reach external functions. Lazy binding updates relevant GOT slots on first use, while Full RELRO protects them after startup.
- •
- •
How it works
- •
First call to an external function (e.g.
puts) jumps to its PLT stub, which jumps through its GOT entry — initially pointing back into the dynamic loader's resolver. - •
The resolver looks up
puts's real address in libc and overwrites the GOT entry with it ("lazy binding" — resolution deferred until first use). - •
Every subsequent call to
putsgoes: call -> PLT stub -> GOT entry (now the real libc address) -> directly into libc, no resolver involved. - •
First call: call puts@plt -> PLT stub -> GOT["puts"] -> resolver -> patches GOT Later calls: call puts@plt -> PLT stub -> GOT["puts"] -> real puts() in libc directly
- •
- •
When to use it
- •
With Partial or No RELRO, relevant PLT/GOT slots may be writable. Verify the exact slot and its runtime mapping.
- •
checksecshowsFull RELRO-> see Full RELRO; GOT overwrite is not viable, look elsewhere. - •
Trace the next executed call and its relocation to identify the slot actually used. Then check whether the target function calls through it too.
- •
- •
Examples
- •
If
puts's GOT slot is writable, redirect it towin; the next call through that slot reacheswin. - •
Check whether
winitself callsputs: that can cause Self-Referential GOT Overwrite (Target Depends on Corrupted Slot).
- •
- •
pwntools
- •
elf = ELF('./vuln') print(hex(elf.got['puts']), elf.relro)
- •
- •
Debugging
- •
got x/gx <got_slot_address>
- •
- •
- •
Cards
- •
Why are lazy-binding GOT slots writable before resolution?
- •
The resolver must fill them with library addresses. Full RELRO resolves them at startup and protects the GOT afterward.
- •
- •
What makes a GOT-overwrite exploit effective even against code the program never explicitly calls?
- •
It doesn't need the program to call the target directly — it redirects a call the program was already going to make (to some other, legitimately-used function) into the attacker's target instead.
- •
- •