Class 08 · KP 03 / 20

Dynamic Linking: Where Does printf Live?

%p leaks these slots; %n writes to them — an arbitrary read/write primitive.

Your program calls printf, puts, system — but that code lives in a shared library (libc), loaded separately at runtime.
The compiler does not know libc's address at build time (and with ASLR it changes every run), so it cannot hardcode the call target.
The linker solves this with two tables:
PLT (Procedure Linkage Table): small stub code, one per imported function. This is what call printf@plt jumps to.
GOT (Global Offset Table): a table of data pointers — the actual runtime addresses of libc functions, filled in by the dynamic linker.

Key Takeaway

The PLT is code you jump through; the GOT is data holding the real address. The GOT is the pivot point for both leaks and overwrites.