Made the hook syscall function set the syscall table back to read-only once it's done (so that nothing is suspicious). Removed the unhook syscall function - this is the same as just hooking the original call back on.