[lytigas]

For a structured approach to ptrace/syscall rewriting, you could try FB's reverie. I worked on and used it during an internship a few years back; it's pretty amazing at what it does.

https://github.com/facebookexperimental/reverie