Syscalls-Extractor

Quick script for automatically extracting syscall numbers for an OS

$ python3 .\syscalls-extractor.py --help
usage: syscalls-extractor.py [-h] [-d PE_DIRECTORY]

Automatically extracts syscall numbers for an OS

optional arguments:
  -h, --help            show this help message and exit
  -d PE_DIRECTORY, --pe-directory PE_DIRECTORY

$ python3 .\syscalls-extractor.py
[*] Printing syscall numbers for ntoskrnl.exe in C:\Windows\System32

[*] 38  (0x26) = ntoskrnl.exe : ZwOpenProcess
[*] 193 (0xc1) = ntoskrnl.exe : ZwCreateThreadEx
[*] 58  (0x3a) = ntoskrnl.exe : ZwWriteVirtualMemory
[*] 24  (0x18) = ntoskrnl.exe : ZwAllocateVirtualMemory
[*] 74  (0x4a) = ntoskrnl.exe : ZwCreateSection
[*] 40  (0x28) = ntoskrnl.exe : ZwMapViewOfSection
[*] 185 (0xb9) = ntoskrnl.exe : ZwCreateProcess
[*] 80  (0x50) = ntoskrnl.exe : ZwProtectVirtualMemory

[+] Done

Adding syscalls

Add to the syscalls dict at the top of the script to add more functions to check for syscalls.

E.g.:

syscalls = {
    "ntoskrnl.exe": [
        "ZwOpenProcess",
        "ZwCreateThreadEx",
        "ZwWriteVirtualMemory",
        "ZwAllocateVirtualMemory",
        "ZwCreateSection",
        "ZwMapViewOfSection",
        "ZwCreateProcess",
        "ZwProtectVirtualMemory"
    ],
}

Native and debug symbols are checked.

Logic

This works by finding the function, locating the next jmp instruction and confirming that the instruction before hand was a mov eax. If so the value moved into eax is returned as the syscall instruction.

Quick script for automatically extracting syscall numbers for an OS

Related tags

Overview

Syscalls-Extractor

Adding syscalls

Logic

Owner

m0rv4i

Desafio Final do Mod1 do Bootcamp EDC - v2 usando a RAIS

Esercizi di Python svolti per il biennio di Tecnologie Informatiche.

Python wrapper to different clients to determine how a particular term is used.

BlueBorne Dockerized

Analyzes crypto candles over a set time period and then trades based on winning patterns found

An extended, game oriented, turtle

This speeds up PyCharm's package index processes and avoids CPU & memory overloading

A free and powerful system for awareness and research of the American judicial system.

Programmatic interface to Synapse services for Python

GitHub Actions Version Updater Updates All GitHub Action Versions in a Repository and Creates a Pull Request with the Changes.

A project to find out all the words in a crossword.

A webapp for taking fast notes, designed for business, school, and collaboration with groups.

Liquid Rocket Engine Cooling Simulation

vFuzzer is a tool developed for fuzzing buffer overflows, For now, It can be used for fuzzing plain vanilla stack based buffer overflows

flake8 plugin which forbids match statements (PEP 634)

Repo contains Python Code Reference to learn Python in a week, It also contains Machine Learning Algorithms and some examples for Practice, Also contains MySql, Tableau etc

A Sophisticated And Beautiful Doxing Tool

A Python feed reader library.

A professional version for LBS

Simple script to match riders with drivers.