Log in

View Full Version : Syscall lister


omega_red
December 15th, 2005, 12:45
I have finished (sort of) my little utility that lists all NT syscalls and matches them with appropriate native APIs. Test with care, though, I don't guarantee that it won't crash your system (although I tested it on different machines and OSes).

ry.pl/~omega/progs/syscall.zip

[edit]
Hmm, seems like last build has some problems with obtaining symbols.. I'll check it later :|

[edit]
Fixed. Duh, weirdness of symserv: it creates 2 directories with symbol files, one specified in search path, and the other named "sym". I specified "sym" in the search path, so it prolly conflicted with the second...

Kayaker
December 15th, 2005, 19:03
Nice piece of code omega_red. I like the practical use (exploit?) of MmGetSystemAddressForMdlSafe to grab a copy of the SSDT. It worked fine on both 2K and XP. Because of the long listing I'll just add the reminder that output can be redirected to a text file with
syscall.exe > output.txt

Regards,
Kayaker

omega_red
January 13th, 2006, 08:02
Update: fixed bug in counting parameters.

omega_red
July 10th, 2006, 15:14
Update: after some poking around, I've made 64bit version (AMD64) to work (I think )
You can get it from here: http://ry.pl/~omega/progs/syscall64.zip

BTW: as FASTCALL is the default calling convention in win x64, is it possible to get syscalls parameter info like in win32? I noticed that parameter-info tables are zeroed in win x64.