It's actually quite simple. LD_PRELOAD can achieve a similar effect, if the software is using the typical syscall library.
A similar idea is used to trace what 'make install' does so that stuff can be uninstalled later - or made into a package (rpm, dpkg etc)
I forget what that tool is called.