title: PLT GOT: How "jmp DWORD PTR [ebx+0xc]" takes control to GOT?
body: <p>For puts@plt, control should go from main to PLT to GOT. Control is going to PLT but from PLT how &quot;jmp DWORD PTR [ebx+0xc]&quot; takes control to GOT? In GDB, ebx=0, so ebx+0xc=0xc, which is weird. Where am I missing the flow?</p>
  <pre><code>└─# cat main.c                                                               
  #include &lt;stdio.h&gt;
      
  int main() {
          printf (&quot;Hello World!\n&quot;);
          return 0;
  }
  
  └─# gcc -m32 -g main.c -o main                                               
  
  
  └─# objdump -Mintel -d --no-show-raw-insn main
  
  main:     file format elf32-i386
  :::
  0000119d &lt;main&gt;:
      119d:       lea    ecx,[esp+0x4]
      11a1:       and    esp,0xfffffff0
      11a4:       push   DWORD PTR [ecx-0x4]
      11a7:       push   ebp
      11a8:       mov    ebp,esp
      11aa:       push   ebx
      11ab:       push   ecx
      11ac:       call   11d9 &lt;__x86.get_pc_thunk.ax&gt;
      11b1:       add    eax,0x2e4f
      11b6:       sub    esp,0xc
      11b9:       lea    edx,[eax-0x1ff8]
      11bf:       push   edx
      11c0:       mov    ebx,eax
      11c2:       call   1030 &lt;puts@plt&gt;    &lt;-- go to addr 1030 (supposed to be in PLT)
      11c7:       add    esp,0x10
      11ca:       mov    eax,0x0
      11cf:       lea    esp,[ebp-0x8]
      11d2:       pop    ecx
      11d3:       pop    ebx
      11d4:       pop    ebp
      11d5:       lea    esp,[ecx-0x4]
      11d8:       ret    
  
  └─# objdump -Mintel -D -j main -j .plt -j .got.plt --no-show-raw-insn main   
  
  main:     file format elf32-i386
  
  
  Disassembly of section .plt:
  
  00001020 &lt;puts@plt-0x10&gt;:
      1020:       push   DWORD PTR [ebx+0x4]
      1026:       jmp    DWORD PTR [ebx+0x8]
      102c:       add    BYTE PTR [eax],al
          ...
  
  00001030 &lt;puts@plt&gt;:
      1030:       jmp    DWORD PTR [ebx+0xc]    &lt;-- Go to ebx+0xc = 0xc (in gdb, ebx=0) !!
      1036:       push   0x0                        (it should have gone to GOT)
      103b:       jmp    1020 &lt;_init+0x20&gt;
  
  00001040 &lt;__libc_start_main@plt&gt;:
      1040:       jmp    DWORD PTR [ebx+0x10]
      1046:       push   0x8
      104b:       jmp    1020 &lt;_init+0x20&gt;
  
  Disassembly of section .got.plt:
  
  00004000 &lt;_GLOBAL_OFFSET_TABLE_&gt;:
      4000:       cld    
      4001:       add    BYTE PTR ds:[eax],al
          ...
      400c:       adc    BYTE PTR ss:[eax],al
      400f:       add    BYTE PTR [esi+0x10],al
          ...
                                                                                                                                                                                                                                                                                                                                                                      
  </code></pre>