Lazy Binding: The GOT Is Resolved On Demand

• By default (partial RELRO) the GOT is resolved lazily: a function's real address is looked up the first time it is called, not at startup.
• First call to printf:
• call printf@plt jumps to the PLT stub.
• The stub jumps to whatever the GOT entry points to — initially back into the resolver.
• The resolver finds the real printf in libc and writes that address into the GOT entry.
• Every later call: PLT stub reads the GOT entry, which now points straight at libc — fast path.