I am trying to better understand PLT and GOT.
- Since every Linux executable has a PLT and a GOT, does it mean that in a process, there are more than one PLT and one GOT?
- When people talk about hooking PLT or GOT, which ones are they referring to? I assume they are referring to the main executable's PLT and GOT?
- How do PLT hooking actually work? PLT contains assembly instructions that jump to the GOT (which contains an entry for the address). So does PLT hooking means patching the actual assembly instructions to jump to a different address and GOT hooking simply replaces the address entry?