__change_syscall
__change_syscall(_metadata, tracee, &syscall, NULL);
__change_syscall(_metadata, tracee, &syscall, &ret);
__change_syscall(_metadata, tracee, syscall_nr, syscall_ret);