I dont think it is as hard as it it sounds.

Consider, for example, hooking all fclose function calls and testing on every call whether

* you have write permission on the file,

* its an object file,

* its in an architecture your exploit supports,

* it uses the fclose function (or the corresponding system call, if it is linked statically)

* and your exploit is not already present.

If those conditions are true, hook the fclose calls in the object file before actually closing it, otherwise just close it normally.