How does NVBIT hook to CUDA events?

[CarloRamponi]

Hello,
You mentioned in the paper that nvbit hooks at some library functions using the LD_PRELOAD method.
I was able to reproduce this when the application is using the Driver APIs, since libcuda is dynamically linked and so hooking functions like cuCtxCreate or cuLaunchKernel is pretty straightforward.
But I don't understand how this is possible when the application uses the Runtime APIs.
In this case it looks to me that the library is statically linked to the application binary:

$ ldd hello
	linux-vdso.so.1 (0x00007ffff7fc5000)
	libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x00007ffff7c00000)
	libm.so.6 => /usr/lib/libm.so.6 (0x00007ffff7b11000)
	libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x00007ffff7eb8000)
	libc.so.6 => /usr/lib/libc.so.6 (0x00007ffff7920000)
	/lib64/ld-linux-x86-64.so.2 => /usr/lib64/ld-linux-x86-64.so.2 (0x00007ffff7fc7000)

Even though when tracing the application I can see something:

dlopen("libcuda.so.1", 2)                                                       = 0x55555561a9c0
pthread_once(0x5555556062bc, 0x5555555763c0, 0, 0)                              = 0
dlsym(0x55555561a9c0, "cuGetProcAddress_v2")                                    = 0x7ffff58b7bd0

Can you clarify this aspect?
What functions does nvbit "overwrite"?