Hi all,
I have been trying to intercept all the system calls on my system, and want to do it for certain processes only.
I tried playing around with the code in entry_32.S in the kernel sources. If I try to change the value of sys_call_table, the kernel crashes while trying to start the init process. This also happens if I try to move the same value into sys_call_vector again..
i.e, something like

pushl %ecx
movl $sys_call_table, %ecx
movl %ecx, $sys_call_table
popl %ecx
call *sys_call_table(,%eax,4)

Any suggestions ?

--
Cheers
ARviND

What is your goal? If you just want to debug calls, you could use gdb and break functions from there. To see list of called system functions you can use strace. But if you really want to intercept call and replace it with something else, then you'll have to write your own version of required library and play with LD_PATH.

>What is your goal?
to intercept all the system calls on my system, and want to do it for certain processes only.

I am not trying to intercept a system call, but trying to override it.

I am aware that binary rewriting is a good technique to intercept system calls, but again, that is not what I want to achieve.

Thanks for your help anyways..