title: How to hook ALL linux system calls during a binary execution
body: <p>I am trying to modify linux system call's default behavior. At the moment I am trying to hook and add a simple print statement before they are actually getting invoked. I know about the standard 'wrap' option of GCC linker and how it can be used to hook wrappers <a href="http://ftp.gnu.org/old-gnu/Manuals/ld-2.9.1/html_node/ld_3.html" rel="nofollow">Link to GCC Linker options</a>. This perfectly works for open(), fstat(), fwrite() etc (where I am actually hooking the libc wrappers). </p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>The limitation is that NOT all system calls gets hooked up with this approach.
  To illustrate that let us take a simple statically compiled binary. When we try adding wrappers, they are getting effected from the calls that we introduce after <em>main()</em> (Please see the strace output shown below)</p>
  
  <pre><code>&gt; strace ./sample 
  
  execve("./sample", ["./sample"], [/* 72 vars */]) = 0
  uname({sys="Linux", node="kumar", ...})   = 0
  brk(0)                                  = 0x71f000
  brk(0x7201c0)                           = 0x7201c0
  arch_prctl(ARCH_SET_FS, 0x71f880)       = 0
  readlink("/proc/self/exe", "/home/admin/sample"..., 4096) = 41
  brk(0x7411c0)                           = 0x7411c0
  brk(0x742000)                           = 0x742000
  access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
  fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
  mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fbcc54d1000
  write(1, "Hello from the wrapped readlink "..., 36Hello from the wrapped readlink :з
  ) = 36
  readlink("/usr/bin/gnome-www-browser", "/etc/alternatives/gnome-www-brow"..., 255) = 35
  write(1, "/etc/alternatives/gnome-www-brow"..., 36/etc/alternatives/gnome-www-browser
  ) = 36
  exit_group(36)                          = ?
  +++ exited with 36 +++
  </code></pre>
  
  <p>If we notice the binary carefully the first "un-intercepted" call readlink() (system call 89 i.e. 0x59) comes from these lines -- some linker related code portion (i.e. <em>_dl_get_origin</em>) does a <em>readlink()</em> for its functioning. These implicit syscall (though present in binary code) are never getting hooked up by our "wrap" approach.</p>
  
  <pre><code>  000000000051875c &lt;_dl_get_origin&gt;:
    51875c:       b8 59 00 00 00          mov    $0x59,%eax
    518761:       55                      push   %rbp
    518762:       53                      push   %rbx
    518763:       48 81 ec 00 10 00 00    sub    $0x1000,%rsp
    51876a:       48 89 e6                mov    %rsp,%rsi
    51876d:       0f 05                   syscall 
  </code></pre>
  
  <p><strong>How to extend the wrapping idea to system calls like readlink() (including all the implicit ones being invoked) ?</strong></p>