Accordingly, the authors modify the kernel of LINUX by loading LKM (loadable kernel module) to hold up system calls of file system by modifing the system_call_table;

• 使用内核可加载模块修改LINUX内核,通过修改内核中的系统调用表拦截对文件系统的系统调用;