add syscalltable hook detection