> dlopen Doesn't that just end up calling open() and mmap()? Might not have access to the args passed through at that point, but that's going to leave a trail

> dlopen Doesn't that just end up calling open() and mmap()? Might not have access to the args passed through at that point, but that's going to leave a trail and of course anything interesting the mapped program does will end up going through syscalls(opening other "files").