[b6fan]

Or use dlopen, dlsym to get the real function.

[CUViper]

Yes, as long as dlopen and dlsym aren't also hooked.

You could also use asm to directly invoke sys_ptrace, since this rootkit doesn't have any kernel components.