add kprobe at sys_fork and enable changing all fields in pt_regs