Hi,
I'm wondering if there's a good way of detecting the loading of
libraries by processes (I am specifically NOT talking about the uselib
syscall).
strace shows me apps do open(...)/mmap/mprotect
I'm currently intercepting mmap calls, however no additional context
records are given to provide the name of the library, and the file
descriptor is the 5th parameter, so I can't get that either to match it
to an open(...)
Is there a way to do this that I'm missing ?
Thanks,
Hassan