fix for detecting dll injection as stack_rwx change