You need uretprobe but also need to read an arg by ref so no I don't think so... But thanks for the tip