1. A method for detecting and halting execution of malicious code, the method comprising: creating a plurality of wrapper functions that each correspond to one of a plurality of library functions in an application; intercepting a system call request from the application to a library function; redirecting the system call request to a wrapper function from the plurality of created wrapper functions that corresponds to the library function; using the wrapper function to determine a memory region from which the system call request emanates, wherein the wrapper function determines whether return addresses associated with one or more intermediate functions in the system call request emanate from a write protected memory region; and executing the system call request based at least in part on the determined memory region.