Lets check what this stub should do being injected in some linux process via __malloc_hook/__free_hook (btw this implicitly means than you cannot use this dirty hack for processes linked with musl or uClibc - they just don't have those hooks)
- bcs our stub can be called from two different hooks we should store somewhere via which entry point we was called
- restore old hooks values
- call dlopen/dlsym and then target function (and pass it address of injection stub for delayed munmap. No, you can't free those memory directly in your target function - try to guess why)
- get right old hook and jump to it if it was installed or just return to code called __malloc_hook somewhere in libc
So I collected all parameters to do job in table dtab consisting from 6 pointers
- __malloc_hook address
- old value of __malloc_hook
- __free_hook address
- old value of __free_hook
- pointer to dlopen
- pointer to dlsym