Intercepting system calls via LD_PRELOAD is a hugely useful approach for many situations. Got a binary-only piece of code that's creating ghost temp files you

Intercepting system calls via LD_PRELOAD is a hugely useful approach for many situations. Got a binary-only piece of code that's creating ghost temp files you want to poke at? Intercept unlink(). Need to quickly (and dirtily) hack an executable that isn't designed for concurrency into sharing a file with other instances of itself? Intercept open(). On the flipside, when trying to do things as securely as possible, never blindly trust dynamic linkage into library functions: attackers can and will use such techniques against you. Reflections on Trusting Trust[1] becomes scarier when you start thinking about all the venues you open with dynamic library linkage. [1] http://cm.bell-labs.com/who/ken/trust.html http://cm.bell-labs.com/who/ken/trust.html