I am disassembling libc-2.23.so, there exists a thunk method called j_free which jumps at the location pointed to by free_ptr pointer in glibc. Why do those even exist while free() itself is exported?

enter image description here

  • 1
    what exactly are you disassembling?
    – Igor Skochinsky
    Apr 27 '17 at 19:02
  • I am disassembling libc-2.23.so, seems that j_free is a thunk method Apr 27 '17 at 22:54

In ELF, all symbols are global. it means that a symbol in another module (e.g. main executable) can override the glibc's free. that's why all calls to it go through a GOT pointer. On the first call, the dynamic linker will go through all symbols in all modules and pick up the first one offering free. If no other modules export it, the libc one will be used.

  • Does it make sense to have calls internal to libc to be routed through plt instead of a relative call? May 4 '17 at 9:06
  • yes, because it needs to be prepared for possibility that they're overridden by an external module.
    – Igor Skochinsky
    May 4 '17 at 9:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.