UNIX for Advanced & Expert Users

I am trying to load into the kernel a system-call dynamically (without restarting the kernel and compailing it) in an attempt to (once in kernel mode) write to user process's memory.

(I know there is a way to do this with the ptrace interface but it is not an option.)

I know the only way to do this is to load a module. In order to allow the user communicating with it, i was told to use a character device (which is supposed to be in /dev/, right?). I loaded one successfully. My problem is that i don't know how the user process access it without an system call. (i was told to use ioctl) Could anyone show how a user process can call ioctl for example that was loaded by my module?

Thanks, Shai

Code:

int val;
int fd=open("/dev/mydev", O_RDWR);
ioctl(fd, some_ioctl, &val);

If you need more detail than that, I'll need more detail from you. I don't even know what operating system you're on, let alone what your driver's doing...