Why the Hooks Went Away

• For years, __free_hook and __malloc_hook were the easiest "one write to shell" targets: writable function pointers called on every allocation event.
• They existed for debugging and custom allocators — a legitimate feature abused into a universal exploit target.
• glibc 2.34 (2021) removed them. This is a deliberate attack-surface reduction: delete the feature, delete the technique.
• Attackers adapted (as always) to file-stream vtables and exit handlers — but those require more setup and more checks to pass.