Applications And System Calls

An application is one (or more) sets of executable files that together accomplish a task (or three).

An application accesses (almost) all system resources (files, etc.) by invoking system calls.

A system call invocation is usually performed by using a 'software interrupt' - thus making all system call invocations pass via a single kernel function.

This implies that hooks can be easily added when system calls are invoked. One major hook allows one process to 'trace' system calls invoked by another process.