tracehook: syscall