SyscallHookingLKM An example of Syscall Hooking # insmod syshook.ko sys_call_table_addr="0xffffffff81401200" $ ./gccrun 'exit(3);' # yes, gcc generates code using sys_exit_group instead $ dmesg | tail -n1 [ 2351.072440] Hooked sys_exit_group (3) # rmmod syshook