jackery001/fetch_syscalls

An IdaPython tool for getting syscall's ID and function name from ntdll.dll, user32.dll, and so on.

Tool of fetch windows syscalls

author : @55-AA, Sept 23, 2016

##Introduction

This IdaPython script fetchs syscall's ID and function name from those Windows dlls with IDA Pro, such as ntdll.dll, user32.dll.

It requires IDA 6.8 and later. For getting function prototypes, A Pdb file is required when the dll is first opened to analyze.

If not a H_APIs.h, You need generate it from ntgdi_reactos.h, ntuser_reactos.h and ntuser_w2k.h, then use 'Alt+F7' to open this script to run. The H_APIs.h supply the prototype, when IDA cannot get it.

The last, you can obtain a output file at the script path.

A example of function fetched from IDA is following:

.text:77D74BF9      _NtUserGetPriorityClipboardFormat@8 proc near
.text:77D74BF9             mov     eax, 11BDh
.text:77D74BFE             mov     edx, 7FFE0300h
.text:77D74C03             call    dword ptr [edx]
.text:77D74C05             retn    8
.text:77D74C05      _NtUserGetPriorityClipboardFormat@8 endp

The example of output is following:

......
/*0x116e,03*/BOOL NtUserDeleteMenu(HMENU,UINT,UINT);
/*0x1211,03*/BOOL NtUserRemoveMenu(HMENU,UINT,UINT);
/*0x122d,03*/BOOL NtUserSetMenuDefaultItem(HMENU,UINT,UINT);
/*0x1172,01*/BOOL NtUserDestroyMenu(HMENU);
/*0x11ef,06*/BOOL NtUserMoveWindow(HWND,INT,INT,INT,INT,BOOL);
/*0x1158,01*/BOOL NtUserCheckDesktopByThreadId(DWORD);
......

The columns meanning above:

ID, Paramster count, Function prototype

##Todo I cannot get prototype and parameter count on x64 PE, so I need a new way. In fact, there are many function, their prototype are identical with x86 ones.

##References

• idapython_docs
• idaapi.py