How does ltrace (library tracing tool) work?
How ltrace works? How does it find out that program's calling library functions? Is there any common code path that all calls to library functions come through? Maybe ltrace is setting breakpoint in this common code path? Thanks! Dynamic executables have a symbol table used by the linker when resolving references that need to be connected to library functions. (You can see this yourself by running objdump -T /path/to/binary ). This symbol table is accessible by other tools -- such as ltrace -- as well, so it's trivial to determine which functions need to be hooked and walk that list