[rough] mapping system call numbers of Zw APIs from local ntdll.dll on Windows 10 by binaryninja

syscall_number_mapper.py

from binaryninja import *

log_to_stderr(1)

def get_syscall_no(zwf):
    for b in zwf.basic_blocks:
        for i in b.get_disassembly_text():
            if str(i).startswith("syscall"):
                eax = zwf.get_reg_value_at(i.address, "eax")
                if eax.type == RegisterValueType.ConstantValue:
                    return eax.value
                else:
                    raise Exception("couldn't determine syscall number.")

    raise Exception("syscall not found")

log_info("[*] loading ntdll.dll...")
ntdll = BinaryViewType['PE'].open("C:\\Windows\\System32\\ntdll.dll")

log_info("[*] analyzing ntdll.dll...")
ntdll.update_analysis_and_wait()

ZwFunctions = (
    function for function in ntdll.functions if function.name.startswith("Zw"))

log_info("[*] mapping syscall numbers..")

for f in ZwFunctions:
    log_info("- now processing: %s" % (f.name))
    try:
        syscallno = get_syscall_no(f)
    except Exception as e:
        log_error(str(e))

    print("%s\t%s" % (f.name, str(syscallno)))

syscall_numbers.tsv

python syscall_number_mapper.py > syscall_numbers.tsv