I'm very glad to hear about your project using utrace! Please feel free to start some new pages on the utrace wiki about your project or showing examples you are interested in seeing.
If you have not been already, you may want to follow the discussions on this list about changes to the report_syscall_entry protocol. (But those are finer details than the basic model of use that you are asking about, so don't let them be a distraction. You can get your prototype functioning before you worry about those arcane corners.) What you want to do should be relatively straightforward. All you have to do to skip the system call is make your report_syscall_entry callback return UTRACE_RESUME | UTRACE_SYSCALL_ABORT. You can record in your own data structures (whatever you hang off engine->data) that you've made this decision, if that's useful. Then you will (almost immediately) get the report_syscall_exit callback after the system call has been skipped. In this function, you can use syscall_set_error() from <asm/syscall.h> (see the DocBook documentation). You can also set user memory as necessary, or change registers directly to recorded values, whatever you need to do to "replay" a call's effects. Thanks, Roland
