No. Assembly code invokes kernel syscalls by invoking an interrupt or using a syscall opcode. No libc or function calls involved, so LD_PRELOAD can't hook in.
You might even have several libc's in your system. You might have a uClibc + Busybox based initrd and a full glibc based root system.
Btw. how does LD_PRELOAD act together static binaries?
I know apps can invoke kernel syscalls directly, and I'm sure you could name a handful of apps that do this all time. But are you really doing that in your mp3 player?
With LD_PRELOAD you can hook any _function_ call.
A syscall is something different.
It depends how the syscall wrapper within the libc is coded.
Some can be hooked...
It's open(2).
Yes, here on my x86_64 it can be hooked.
But I've seen lots of setups where this was not doable.
As I said it depends how the libc's wrapper is written.
On Linux, there's typically both an open(3) and an open(2). The former is implemented by glibc and calls the latter which is implemented by the kernel.
So an app calls the open() function. This results in an unresolved symbol which the run-time linker matches up with the open() exported by glibc. glibc then does the open() syscall.
libc implements a function called open. Its documentation appears in section 3 of the UNIX manual. Because of that, we call it open(3). Linux implements a system call called open. Its documentation appears in section 2 of the UNIX manual. Because of that, we call it open(2). From assembly, you manually call open(2). From a C program linked against libc, you typically open(3). open(3) can be hooked, because it's just a regular function. open(2) is not a function, and so cannot be hooked like a function.
