Bug Hunter Diary

The program in Listing A-4 calls the printf() library function twotimes. I compiled the program with debugging symbols and startedit in the debugger (see Section B.4 for a description of the followingdebugger commands):linux$ gcc -g -o got got.clinux$ gdb -q ./got(gdb) set disassembly-flavor intel(gdb) disassemble mainDump of assembler code for function main:0x080483c4 : push ebp0x080483c5 : mov ebp,esp0x080483c7 : and esp,0xfffffff00x080483ca : sub esp,0x200x080483cd : mov DWORD PTR [esp+0x1c],0x100x080483d5 : mov eax,0x80484d00x080483da : mov edx,DWORD PTR [esp+0x1c]0x080483de : mov DWORD PTR [esp+0x4],edx0x080483e2 : mov DWORD PTR [esp],eax0x080483e5 : call 0x80482fc 0x080483ea : mov eax,0x80484d40x080483ef : mov edx,DWORD PTR [esp+0x1c]0x080483f3 : mov DWORD PTR [esp+0x4],edx0x080483f7 : mov DWORD PTR [esp],eax0x080483fa : call 0x80482fc 0x080483ff : mov eax,0x00x08048404 : leave0x08048405 : retEnd of assembler dump.The disassembly of the main() function shows the address ofprintf() in the Procedure Linkage Table (PLT). Much as the GOT redirectsposition-independent address calculations to absolute locations,the PLT redirects position-independent function calls to absolutelocations.(gdb) x/1i 0x80482fc0x80482fc : jmpDWORD PTR ds:0x80495d8The PLT entry jumps immediately into the GOT:(gdb) x/1x 0x80495d80x80495d8 :0x08048302If the library function wasn’t called before, the GOT entry pointsback into the PLT. In the PLT, a relocation offset gets pushed onto158 Appendix A