Intercept Provides an abstraction to the kernel interface: Run a binary and attach to it. Callbacks for system calls: intercept_register_sccb("native", "open", trans_cb, NULL); Generic framework for system call argument translation. intercept_register_transfn("native", "open", 0); intercept_register_translation("native", "open", 1, &oflags); System call argument replacement. intercept_replace_init(&repl); intercept_replace_add(&repl, tl->off, tl->trans_data, tl->trans_size); [...] intercept_replace(fd, pid, &repl);