x86 dirty hack to get syscall table address, https://github.com/ultral/linux-keylogger/blob/master/keylogger.c#L40-L59

syscall_table_x86.asm

; TODO: belum di test, mungkin broken (?)

global _start
section .text
_start:

    mov ecx, 0xc0000082
    rdmsr
    mov edx, 32
    mov ecx, edx
    sal edx, cl
    or eax, edx

.loop_init:
    mov ecx, eax
    add ecx, 500
    jmp .loop_body

.loop:
    add eax, 1
    cmp ecx, eax
    je .fail

.loop_body:
    cmp byte [eax], 0xff
    jne .loop
    cmp byte [eax+1], 0x14
    jne .loop
    cmp byte [eax+2], 0xc5
    jne .loop

.success:
    mov ecx, 0xffffffff
    mov eax, dword [eax+3]
    or eax, ecx
    ret

.fail:
    xor eax, eax
    ret