Syscall interception works for _every_ program, it's just a matter of doing it correctly. VDSO is a small set of (3) calls which are not syscalls but direct ca

Syscall interception works for _every_ program, it's just a matter of doing it correctly. VDSO is a small set of (3) calls which are not syscalls but direct calls (for speed/efficiency). Our goal is to remove this functionality to force libs to call through the (slower) syscall route instead. I mention in another comment how EHDR censoring is needed for robust VDSO removal. I've not run into a libc where censoring EHDR breaks time calls (i.e. it doesn't fallback to syscalls) but possibly golang has this. In this case it's straightforward to setup a fake VDSO and then instead of EHDR censoring you just replace it with your fake VDSO address and you're golden!