prevent syscall disturbing by checking EIP address