The disappearing sys_call_table export.
Quoted 3 lines
You might have a derivative work after obtaining access to a non-exported interface. If this is correct, binary-only modules can't do this and therefore they must stick to exported interfaces.
And what about modules that just hook syscall directly by hooking int0x80 or messing with sysenter?