(The problem is updated... as the investigation goes deep)
My goal is to intercept all syscalls originated from a shared object file. The requirement is not to modify the kernel code (e.g. can not overwrite the syscall table).
I am considering static binary rewriting technique (specifically, dyninst) to do the job. However, dyninst can only specify instrumentation points by function name. While it is possible to exhaust all syscall functions, can dyninst or one of other static binary rewriting tools allow user to instrument at instruction level. That is, use
syscall instruction as instrumentation point.
(I do prefer static instrumentation over the dynamic one, since I need to instrumen one specific shared object.)