Thanks for the paper @_py!
Reading your newest article Linux Internals - The Art Of Symbol Resolution plus reading this again really makes sense, as I’m able to understand it in just one shot! I love how you introduced the concept of GOT through array indices [0][1][2], which really makes sense for me.
It’s actually e6 82 04 08
in the little-endian. It’s on the first and second line.
This is because the instruction jmp *0x804a00c
will take the 4 bytes value at the 0x804a00c
address. You can imagine that this instruction is the same as jmp dword ptr [0x804a00c]
.
But this is an old write up of yours, so I guess you already know about this thing.
Cheers, thanks again for the paper!