Syscalls-Extractor

Quick script for automatically extracting syscall numbers for an OS

$ python3 .\syscalls-extractor.py --help
usage: syscalls-extractor.py [-h] [-d PE_DIRECTORY]

Automatically extracts syscall numbers for an OS

optional arguments:
  -h, --help            show this help message and exit
  -d PE_DIRECTORY, --pe-directory PE_DIRECTORY

$ python3 .\syscalls-extractor.py
[*] Printing syscall numbers for ntoskrnl.exe in C:\Windows\System32

[*] 38  (0x26) = ntoskrnl.exe : ZwOpenProcess
[*] 193 (0xc1) = ntoskrnl.exe : ZwCreateThreadEx
[*] 58  (0x3a) = ntoskrnl.exe : ZwWriteVirtualMemory
[*] 24  (0x18) = ntoskrnl.exe : ZwAllocateVirtualMemory
[*] 74  (0x4a) = ntoskrnl.exe : ZwCreateSection
[*] 40  (0x28) = ntoskrnl.exe : ZwMapViewOfSection
[*] 185 (0xb9) = ntoskrnl.exe : ZwCreateProcess
[*] 80  (0x50) = ntoskrnl.exe : ZwProtectVirtualMemory

[+] Done

Adding syscalls

Add to the syscalls dict at the top of the script to add more functions to check for syscalls.

E.g.:

syscalls = {
    "ntoskrnl.exe": [
        "ZwOpenProcess",
        "ZwCreateThreadEx",
        "ZwWriteVirtualMemory",
        "ZwAllocateVirtualMemory",
        "ZwCreateSection",
        "ZwMapViewOfSection",
        "ZwCreateProcess",
        "ZwProtectVirtualMemory"
    ],
}

Native and debug symbols are checked.

Logic

This works by finding the function, locating the next jmp instruction and confirming that the instruction before hand was a mov eax. If so the value moved into eax is returned as the syscall instruction.

Quick script for automatically extracting syscall numbers for an OS

Related tags

Overview

Syscalls-Extractor

Adding syscalls

Logic

Owner

m0rv4i

KUIZ is a web application quiz where you can create/take a quiz for learning and sharing knowledge from various subjects, questions and answers.

Chalice - A tool to facilitate Python based lambda deployment

Online-update est un programme python permettant de mettre a jour des dossier et de fichier depuis une adresse web.

A new mini-batch framework for optimal transport in deep generative models, deep domain adaptation, approximate Bayesian computation, color transfer, and gradient flow.

tidevice can be used to communicate with iPhone device

A tool that bootstraps your dotfiles ⚡️

Plugin to generate BOM + CPL files for JLCPCB

Mines all the moneys and stuff and things.

API to summarize input text

nbsafety adds a layer of protection to computational notebooks by solving the stale dependency problem when executing cells out-of-order

Tools for dos (denial-of-service) website / web server

Refer'd Resume Scanner

Python library to decode the EU Covid-19 vaccine certificate

A practice program to find the LCM i.e Lowest Common Multiplication of two numbers using python without library.

Unofficial package for fetching users information based on National ID Number (Tanzania)

Quantity Takeoff with Python. Collecting groups of elements by filters

Simple Wayland HotKey Daemon

This repository contains the code for the python introduction lab

Python’s bokeh, holoviews, matplotlib, plotly, seaborn package-based visualizations about COVID statistics eventually hosted as a web app on Heroku

Various hdas (Houdini Digital Assets)