I am disassembling libc-2.23.so, there exists a thunk method called j_free which jumps at the location pointed to by free_ptr pointer in glibc. Why do those even exist while free() itself is exported?

enter image description here

  • 1
    what exactly are you disassembling?
    – Igor Skochinsky
    Commented Apr 27, 2017 at 19:02
  • I am disassembling libc-2.23.so, seems that j_free is a thunk method
    – sherlock
    Commented Apr 27, 2017 at 22:54

1 Answer 1


In ELF, all symbols are global. it means that a symbol in another module (e.g. main executable) can override the glibc's free. that's why all calls to it go through a GOT pointer. On the first call, the dynamic linker will go through all symbols in all modules and pick up the first one offering free. If no other modules export it, the libc one will be used.

  • Does it make sense to have calls internal to libc to be routed through plt instead of a relative call?
    – sherlock
    Commented May 4, 2017 at 9:06
  • yes, because it needs to be prepared for possibility that they're overridden by an external module.
    – Igor Skochinsky
    Commented May 4, 2017 at 9:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.