I'd start with this tutorial on how to write a debugger using ptrace, it's not too difficult to go to spoofing syscalls from there: https://eli.thegreenplace.ne

I'd start with this tutorial on how to write a debugger using ptrace, it's not too difficult to go to spoofing syscalls from there: https://eli.thegreenplace.net/2011/01/23/how-debuggers-work-part-1 https://eli.thegreenplace.net/2011/01/23/how-debuggers-work-...