Skip to main content
Reverse Engineering

Return to Question

deleted 1 character in body
Source Link
synack
synack
  • 31
  • 2

I'm trying to learn how GOT/PLT works in ELF binaries. The way I see it - there's three sections; .got, .plt and .got.plt.

When the program tries to call an imported functionsfunction which is lazy binded, it does so by calling the plt procedure. In case the entry has not yet been resolved, the jump in the plt section jumps to the address pointed by in the .got.plt section, which points back to the .plt section, where arguments are set up for the dlresolve (an index to the SYMTABJMPREL, among other things, if I'm understanding correctly). The .plt then resolves the address of the function and calls it with the provided arguments. In the next call, when the function has already been resolved, the .plt section jumps again to the address pointed to by the .got.plt section, which now contains the resolved address of the function (so that it doesn't jump back to the .plt section).

It seems that in both cases only the .plt and .got.plt sections are involved, so I'm struggling to understand what's the purpose of the .got section. I read somewhere that it contains the global variables, but that seem to reside in the .data section, so I don't think that's really it.

Thanks!

I'm trying to learn how GOT/PLT works in ELF binaries. The way I see it - there's three sections; .got, .plt and .got.plt.

When the program tries to call an imported functions which is lazy binded, it does so by calling the plt procedure. In case the entry has not yet been resolved, the jump in the plt section jumps to the address pointed by in the .got.plt section, which points back to the .plt section, where arguments are set up for the dlresolve (an index to the SYMTAB, among other things, if I'm understanding correctly). The .plt then resolves the address of the function and calls it with the provided arguments. In the next call, when the function has already been resolved, the .plt section jumps again to the address pointed to by the .got.plt section, which now contains the resolved address of the function (so that it doesn't jump back to the .plt section).

It seems that in both cases only the .plt and .got.plt sections are involved, so I'm struggling to understand what's the purpose of the .got section. I read somewhere that it contains the global variables, but that seem to reside in the .data section, so I don't think that's really it.

Thanks!

I'm trying to learn how GOT/PLT works in ELF binaries. The way I see it - there's three sections; .got, .plt and .got.plt.

When the program tries to call an imported function which is lazy binded, it does so by calling the plt procedure. In case the entry has not yet been resolved, the jump in the plt section jumps to the address pointed by in the .got.plt section, which points back to the .plt section, where arguments are set up for the dlresolve (an index to the JMPREL, among other things, if I'm understanding correctly). The .plt then resolves the address of the function and calls it with the provided arguments. In the next call, when the function has already been resolved, the .plt section jumps again to the address pointed to by the .got.plt section, which now contains the resolved address of the function (so that it doesn't jump back to the .plt section).

It seems that in both cases only the .plt and .got.plt sections are involved, so I'm struggling to understand what's the purpose of the .got section. I read somewhere that it contains the global variables, but that seem to reside in the .data section, so I don't think that's really it.

Thanks!

Source Link
synack
synack
  • 31
  • 2

What is the ELF .got section used for?

I'm trying to learn how GOT/PLT works in ELF binaries. The way I see it - there's three sections; .got, .plt and .got.plt.

When the program tries to call an imported functions which is lazy binded, it does so by calling the plt procedure. In case the entry has not yet been resolved, the jump in the plt section jumps to the address pointed by in the .got.plt section, which points back to the .plt section, where arguments are set up for the dlresolve (an index to the SYMTAB, among other things, if I'm understanding correctly). The .plt then resolves the address of the function and calls it with the provided arguments. In the next call, when the function has already been resolved, the .plt section jumps again to the address pointed to by the .got.plt section, which now contains the resolved address of the function (so that it doesn't jump back to the .plt section).

It seems that in both cases only the .plt and .got.plt sections are involved, so I'm struggling to understand what's the purpose of the .got section. I read somewhere that it contains the global variables, but that seem to reside in the .data section, so I don't think that's really it.

Thanks!