A technically detailed introduction to Kprobes: http://www-users.cs.umn.edu/~boutcher/kprobes/ Many examples of SystemTap (which builds on Kprobes): http://sourceware.org/systemtap/examples/ Ubuntu has a problem with Kprobes/SystemTap implementation. I had to rebuild my kernel to make it work. Some info here: http://posulliv.github.com/2010/02/26/installing-stap.html NB: You mileage may vary! ======== SystemTap one-liner to print the ESP in a system call: stap -e 'probe kernel.function("sys_open").call {printf("ESP %x %s\n", register("esp"), execname() ); }'