You can access the code also from the below link. https://gist.github.com/4634681 On Fri, Jan 25, 2013 at 6:58 PM, Paul Davies C <pauldaviesc@gmail.com>wrote:

Hi, [1] is the module I wrote for intercepting the system call fork(). I have taken the conventional way of hooking the system call. Firstly I found out the address of the sys_call_table from the System.map. Then I used it in the module to substitute for the original fork() with my own version of fork.My version does nothing more than printing a message and returning the original fork(). It didn't gave any errors when loaded to kernel using the insmod. However it seems that the module had no affect on the sys_call_table[] since the fork() is working perfectly after the insertion of module and it does not show me the message it was supposed to print. Can someone figure out the problem? I am using 3.2.0-4-686 version of kernel. [1] http://pastebin.com/aWN3jdQU

-- *Regards,* *Paul Davies C* vivafoss.blogspot.com

-- *Regards,* *Paul Davies C* vivafoss.blogspot.com

On Fri, 25 Jan 2013 18:58:29 +0530, Paul Davies C said:

[1] is the module I wrote for intercepting the system call fork().

Totally skipping over the details of actually doing it - it's usually considered a Bad Idea to hook a system call, and 98% of the time there's a much better way to achieve whatever goal you're trying to accomplish by hooking the syscall. In other words, why are you trying to do that in the first place?