The Procedure Linkage Table (PLT) is a jump table in the .plt section of an ELF binary that dispatches calls to shared-library functions. Each library call in the original source compiles to a call into the PLT rather than directly into the library; the PLT stub dereferences the Global Offset Table to find the function’s resolved runtime address and jumps to it. This indirection is the mechanism that enables dynamic linking.
How It Dispatches
The call path through the PLT
A source-level puts("hi") compiles to call puts@plt. The PLT entry for puts is a short stub:
puts@plt: jmp [GOT + puts_offset] ; indirect jump through the GOT ; first-time path falls back to the dynamic linker, which ; resolves puts, patches the GOT entry, then re-dispatches
The first time a given function is called the GOT entry points back into the resolver, which looks up the symbol, patches the GOT, and re-enters; from then on the GOT holds the resolved address and the call is a single indirect jump.
Bypass Surface
Why the PLT matters to exploitation
The PLT lives in the ELF binary, in .plt, not in any randomised library — so when PIE is disabled the PLT addresses are fixed. That fixed address is the lever for ret2plt: jumping to system@plt costs the attacker nothing in leaks, because they are naming a symbol in the binary rather than a symbol in libc. ASLR does not randomise the PLT; only PIE does. The PLT is therefore the exploiting route left open by ASLR-alone memory layouts, and the route closed by compiling PIE on.