"ptrace()" was casually mentioned by Giles.   But I think it deserved a whole section by itself.   "ptrace()" is a system call API provided by OS (Linux and all UNIX have it, and so do Windows) to exert debug control over another process.   When you used PTRACE_ATTACH (as part of ptrace()) to attach to another process, the kernel will pause the CPU running that process completely, allowing you to make changes to ANY part of the process: CPU, any registers, any part of that process memory etc.   That is how dynamic inline hooking work.    (ptrace() attach, modify binary in-memory, and then ptrace() unattached).   As far as I know, all dynamic modification of another process has to use ptrace() - as that is the only mechanism provided by kernel to guarantee integrity via system call at this point.

But recently similar API like utrace() is popping up, and so 
inline hooking is also theoretically possible:

http://landley.net/kdocs/ols/2007/ols2007v1-pages-215-224.pdf

For kernel hooking, there are many methods:   syscall, interrupt, and inline hooking.   This is for interrupt hooking:

http://mammon.github.io/Text/linux_hooker.txt

When the CPU is in STOP mode, basically you can do anything you like to the CPU/memory space/register - just make sure you restore back to its original state before returning to the original address where it stopped.

And if you use library inject technique, you can implement any functionalities - calling remote libraries, remote shell etc:

https://attack.mitre.org/techniques/T1055/001/

https://stackoverflow.com/questions/24355344/inject-shared-library-into-a-process

https://backtrace.io/blog/backtrace/elf-shared-library-injection-forensics/