On Thu, Jan 26, 2012 at 03:11:14PM +0000, YAMAMOTO Takashi wrote: > do you mean rumphijack? iirc it sits between application and libc. It overwrites the strong syscall symbols, so it covers libc itself as well. Joerg