> It can’t detect the interception

What's stopping the process from reading its own memory and seeing that the syscall was patched?