The Cosmopolitan Libc _start() function starts by intercepting the --ftrace flag. https://github.com/jart/cosmopolitan/blob/master/libc/runtime/ftraceinit.greg.

The Cosmopolitan Libc _start() function starts by intercepting the --ftrace flag. https://github.com/jart/cosmopolitan/blob/master/libc/runtime/ftraceinit.greg.c#L35 https://github.com/jart/cosmopolitan/blob/master/libc/runtim... If it exists, then it opens and sorts of the symbol table from the elf binary. https://github.com/jart/cosmopolitan/blob/master/libc/runtime/opensymboltable.greg.c#L109 https://github.com/jart/cosmopolitan/blob/master/libc/runtim... Then it changes the protection of memory https://github.com/jart/cosmopolitan/blob/master/libc/runtime/morph.greg.c#L60 https://github.com/jart/cosmopolitan/blob/master/libc/runtim... so it's able to iterate over the program's memory to look for nop instructions it can mutate. https://github.com/jart/cosmopolitan/blob/master/libc/runtime/hook.greg.c#L106 https://github.com/jart/cosmopolitan/blob/master/libc/runtim... Those NOPs were inserted by GCC. It's easy to self-modify them in memory, since they have the same byte length as the CALL instruction. Think of it like a mini linker. It just relinks the profiling nops. Once they've been rewritten, functions will start calling https://github.com/jart/cosmopolitan/blob/master/libc/runtime/ftrace-hook.S#L22 https://github.com/jart/cosmopolitan/blob/master/libc/runtim... which saves the CPU state to the stack. That means ftrace kind of acts like an operating system kernel. Once the assembly saved the CPU it can call the C code https://github.com/jart/cosmopolitan/blob/master/libc/runtime/ftracer.c#L113 https://github.com/jart/cosmopolitan/blob/master/libc/runtim... that acquires a reentrant mutex and unwinds the RBP backtrace pointer (via __builtin_frame_address(0)) to determine the address of the function that called it. Once it has the address of the function, it passes it along to kprintf() which has a special syntax for turning numbers into symbols. https://github.com/jart/cosmopolitan/blob/master/libc/intrin/kprintf.greg.c#L519 https://github.com/jart/cosmopolitan/blob/master/libc/intrin... That's really all there is to it!