[therein]

Not necessarily. At least on Android, it is rather simple to just use Xposed Framework to basically "mock syscalls".