Dynamic linking is ubiquitously used, but it's hard to find a detailed, accurate description of how it works. Nevertheless, it is a remarkable example of advanced software engineering, and no modern system is possible without it. Why Solaris abandoned static linking: http://blogs.oracle.com/rie/entry/static_linking_where_did_it == Reading Read the "Dynamic linking and loading" chapter in John Levine's "Linkers and Loaders" (http://www.iecc.com/linker/). Concentrate on ELF linking and loading, but have a look at the Microsoft section if you are curious. Read your dynamic linker's man page. On Linux and Solaris: ld.so == Addtional reading: "Cheating the ELF. Subversive Dynamic Linking to Libraries" by the grugq. https://grugq.github.io/docs/subversiveld.pdf "Modern Day ELF Runtime infection via GOT poisoning" by Ryan O'Neill http://vxheavens.com/lib/vrn00.html [This link may be down. This valuable paper and others were unavailable for a time due to an overzealous and clueless prosecutor in Ukraine, where vxheavens.com was hosted. If not available, try instead: http://web.archive.org/web/20111222005751/http://vxheavens.com/lib/vrn00.html ]. "Linux x86 Program Start Up, or - How the heck do we get to main()?" by Patrick Horgan http://dbp-consulting.com/tutorials/debugging/linuxProgramStartup.html == Suggested homework: Use a dynamically compiled executable on your system (which, say, prints "Hello world" in a loop 10 times) and a debugger to observe the stack and GOT just before and after dynamic linking. What are the arguments that the dynamic linker entry point receives when entered through GOT[]? What else is stored in GOT? Observe how the symbol to be linked is referenced from the PLT stub. Observe the PLT section with "objdump -d " on the executable (pipe to "less"). Find the number of the .got and .got.plt sections. Observe the GOT section with "objdump -s " -- you will see where the the GOT table entries point initially. These GOT entries will be overwritten by the dynamic linker, so that the following reference through GOT to the dynamically linked function points to its actual address in the loaded library. Useful GDB tips: http://www.unknownroad.com/rtfm/gdbtut/gdbadvanced.html Remember that /proc//maps will show you the process' memory layout with all of its currently mapped code, libraries and stack.