I wrote simple shared library: Compiled/built: Disassembled, to see how some_func is referenced: Looked where .got.plt is located: What is the relocation: In 6aa-6bb we get absolute location of GOT: 6aa + 0x200956 = 0x201000 That agrees with readelf -S libtest.so ‘s output. We skip 3 reserved bytes in GOT(functions-related) and determine that some_func’s absolute address should be found at