I was just discussing this sort of thing with some colleagues. Because the stack frame for main contains a bunch of other stuff - environment variables, cli args, etc - it makes it unreliable to try to instrument Linux systems and collect that information. A process can change its name, args, env, at any time. That sort of information is really helpful for forensics. Currently your only option is to pull data directl…
> Very few programs make syscalls directly (except go programs i guess? lol) on Linux You’re forgetting statically compiled binaries, which are very important for ease of deployment and distro-agnostic execution.
Statically compiled binaries almost always still use a libc, either by dynamically linking it or by statically linking it.