Thursday, February 17, 2011

Hooking sycalls from userspace on Linux

Is there any way to catch all syscalls on Linux? The only solution I know of is using LD_PRELOAD à la fakeroot, but that only works for dynamically linked applications. Furthermore, this approach requires enumerating all syscalls which is something I'd like to avoid.

From stackoverflow
  • You can trace a program. Think about how strace works. Hint: it doesn't use LD_PRELOAD tricks.

  • I think you are looking for ptrace(2).

0 comments:

Post a Comment