Syscalls-Extractor

Quick script for automatically extracting syscall numbers for an OS

$ python3 .\syscalls-extractor.py --help
usage: syscalls-extractor.py [-h] [-d PE_DIRECTORY]

Automatically extracts syscall numbers for an OS

optional arguments:
  -h, --help            show this help message and exit
  -d PE_DIRECTORY, --pe-directory PE_DIRECTORY

$ python3 .\syscalls-extractor.py
[*] Printing syscall numbers for ntoskrnl.exe in C:\Windows\System32

[*] 38  (0x26) = ntoskrnl.exe : ZwOpenProcess
[*] 193 (0xc1) = ntoskrnl.exe : ZwCreateThreadEx
[*] 58  (0x3a) = ntoskrnl.exe : ZwWriteVirtualMemory
[*] 24  (0x18) = ntoskrnl.exe : ZwAllocateVirtualMemory
[*] 74  (0x4a) = ntoskrnl.exe : ZwCreateSection
[*] 40  (0x28) = ntoskrnl.exe : ZwMapViewOfSection
[*] 185 (0xb9) = ntoskrnl.exe : ZwCreateProcess
[*] 80  (0x50) = ntoskrnl.exe : ZwProtectVirtualMemory

[+] Done

Adding syscalls

Add to the syscalls dict at the top of the script to add more functions to check for syscalls.

E.g.:

syscalls = {
    "ntoskrnl.exe": [
        "ZwOpenProcess",
        "ZwCreateThreadEx",
        "ZwWriteVirtualMemory",
        "ZwAllocateVirtualMemory",
        "ZwCreateSection",
        "ZwMapViewOfSection",
        "ZwCreateProcess",
        "ZwProtectVirtualMemory"
    ],
}

Native and debug symbols are checked.

Logic

This works by finding the function, locating the next jmp instruction and confirming that the instruction before hand was a mov eax. If so the value moved into eax is returned as the syscall instruction.

Quick script for automatically extracting syscall numbers for an OS

Related tags

Overview

Syscalls-Extractor

Adding syscalls

Logic

Owner

m0rv4i

Minitel 5 somewhat reverse-engineered

A simple projects to help your seo optimizing has been written with python

A simple program which gets a file(CSV/Excel) with tasks and creates different variants

A collection of modern themes for Tkinter TTK

🌲 Um simples criador de arvore de items feito em Python para o Prompt 🐍

Procscan is a quick and dirty python script used to look for potentially dangerous api call patterns in a Procmon PML file.

Sailwind Mod Manager

Python library for creating PEG parsers

BasicVSR++ function for VapourSynth

Easy Alias's for bash

Simple control of Thorlabs Elliptec devices from Python.

Probably the best way to simulate block scopes in Python

A repository containing an introduction to Panel made to be support videos and talks.

Password-Manager - A Password Manager application made using Python. You can use this python application to store and to see the stored passwords

A python library for writing parser-based interactive fiction.

Python program to start your zoom meetings

Better Giveaways is a bot that will change the experience of using a giveaway bot forever.

AKSWINPOSTINIT -- AKS Windows node post provisioning initialization

vFuzzer is a tool developed for fuzzing buffer overflows, For now, It can be used for fuzzing plain vanilla stack based buffer overflows

An ultra fast cross-platform multiple screenshots module in pure Python using ctypes.