I have a small binary compiled as non-pie, but ASLR is enabled, so the shared libraries are randomized. My plan was to leak any libc address from GOT via returning to plt, but the only useful plt-stub i have is a printf. Previously i wrote a working exploit with this method, when i could use puts, but in this case the only output i get after returning to printf@plt is an empty string.
I couldn't find out the reason of this behavior so far; why printf acts like this? Is it even possible to leak an address this way?