3 ms·

Sorry, you're just wrong. Have you ever called a system call by hand using assembly? Have you ever looked at glibc's source? Habe you ever looked at the kern

• calloc 15y ago
  syscall number 5 you mean?
• jrockway 15y ago
  libc implements a function called open. Its documentation appears in section 3 of the UNIX manual. Because of that, we call it open(3). Linux implements a system call called open. Its documentation appears in section 2 of the UNIX manual. Because of that, we call it open(2). From assembly, you manually call open(2). From a C program linked against libc, you typically open(3). open(3) can be hooked, because it's just a regular function. open(2) is not a function, and so cannot be hooked like a function.