The Hijacker Module This module exports syscall hijacking functions - hijack_syscall_before, hijack_syscall_after, release_syscall_before and release_syscall_after. Pointers to hijacking functions are inserted into the kernel's system call table, 'sys_call_table' instead of the pointer to the original system call kernel's function. In order to avoid kernel crashes, invocation reference counting is kept for each system call, and the syscall_hijack.o module cannot be unloaded while one of the system calls (and thus its functions) is active.