retrieve EIP/RIP for syscall in audit