[wmf]

Something I've done a couple times is trace the execution of a system call by reading the code. LXR is really helpful.