Your drives don't all get unmounted. Root gets REMOUNTED as read only. To that end, you'll still have access to everything you'll need. Next, you'll need to look at runlevels 0 and 6 (0 is for HALT and 6 is for reboot). Both of these have an associated /etc/{rc.d,init.d}/ file that executes as the system is going down. You could easily grep inside that directory to find each occurrence of umount or mount -oremount,ro to know where to put your line of bash code that would execute your software.
Code:
THE STUPID CODE TAGS SYSTEM DIDN'T LIKE ME TO USE {} SO I HAD TO PUT THIS IN