RELRO: Protecting the GOT
- The GOT (Global Offset Table) holds resolved addresses of libc functions; the PLT jumps through it. A writable GOT is a favorite hijack target (overwrite an entry → redirect a call).
- Partial RELRO: reorders sections and makes some data read-only, but the GOT is still lazily resolved and writable.
- Full RELRO: resolve all symbols at load time (
now), then mark the entire GOT read-only. A GOT overwrite faults. - Build:
-Wl,-z,relro,-z,now(full);-Wl,-z,relro(partial);-Wl,-z,norelro(none).
Key Takeaway
Full RELRO closes the easiest write-what-where target. Cost: slower startup (eager binding). Attackers pivot to other writable pointers (__malloc_hook, saved returns, function pointers).