OS-hook interposition

one syscall, two destinations