I am currently reading the "Malware Analyst's Cookbook and DVD". There is a chapter "Dynamic Analysis" and there are also some recipes about hooking and monitoring API calls of process but it is for Windows.

I want to do the same thing like recipe 9-10 explains but for Linux. 9-10 is called "Capturing process, Thread, and Image Load Events". In this receipe it is showed "how to implement a driver that alerts you when any events occure on the system while your malware samlpe executes". It uses the API functions of the Windows Driver Kit (WDK) to call a user-defined callback function. It uses the callback functions:

  • Process creation callback function called PsSetCreateProcessNotifyRoutine(...)
  • Thread creation callback function called PsSetCreateThreadNotifyRoutine(...)
  • Image load callback function called PsSetLoadImageNotifyRoutine(...).

And when any events occur it will display them as a debug message which can then be viewed in e.g. DebugView.

It seems well documented for Windows and it is easy to find information for this, but I have a bit of a problem in finding information for Linux.

I've found some general introduction to drivers and a one for hooking, but I still haven't found any that are not so general or at least are a bit more focused on malware analysis.

I would be happy for tips for further readings or recommended tutorials on this topic.

  • Can you please explain the overall process as it's described in this book. I do not have access to it, and it's unlikely that others will have access to this book/chapter too. Doing this will help to bring more eyes to your Q.
    – slm
    Commented Sep 9, 2014 at 3:56
  • Here is a Link to PDF Commented Sep 9, 2014 at 4:06
  • @sim Sry, but I have added it now :-)
    – Greeneco
    Commented Sep 9, 2014 at 5:58

2 Answers 2


This question is a few years old, but still relevant.
Here are some options:


The simplest way is to just run your malware sample with strace.

strace runs the provided command under tracing and outputs (to standard error, or a file if you want) all the system call and their arguments that the application calls.

For example, to capture all calls to create new processes or new threads, one might run:

strace -e trace=clone,fork -o trace.log -f malware
  • -e specify which system calls to log. If you don't specify it then you'd get all system calls in the log.
  • -o specify file to write the trace to
  • -f attach traces to spawned processes

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .