line CODE JT JF K
=================================
0000: 0x20 0x00 0x00 0x00000000 A = sys_number
0001: 0x15 0x00 0x01 0x0000003b if (A != execve) goto 0003
0002: 0x06 0x00 0x00 0x80000000 return KILL_PROCESS
0003: 0x15 0x00 0x01 0x00000142 if (A != execveat) goto 0005
0004: 0x06 0x00 0x00 0x80000000 return KILL_PROCESS
0005: 0x15 0x00 0x01 0x0000000a if (A != mprotect) goto 0007
0006: 0x06 0x00 0x00 0x80000000 return KILL_PROCESS
0007: 0x06 0x00 0x00 0x7fff0000 return ALLOW