Radare Linux System Call Table Helper Script

linux_radare_syscalls.py

#!/usr/bin/env python
"""
Use this script to generate radare2 system call maps
from the systrace static arrays. Run this is the linux/
subdir of the systrace sources and a linux.c will
be generated.

Note, if the maps comes out empty for an arch, open the
relevent syscallent.h and you will probably find that another
arches syscallnt.h is included. In such a case, copy the def
for the correct arch. 

XXX: types of args.

"""

import re

def gen_map(arch, out):
    
    f = open("%s/syscallent.h" % (arch), "r")

    out.write("RSyscallItem syscalls_linux_%s[] = {\n" % arch);

    for line in f:
        line = line.rstrip()

        if (not line.startswith("\t{")):
                continue

        # get the syscall number from the comment
        match = re.search('/\* (.*) \*/$', line)
        if match == None:
            continue

        comment = match.group(1)
        com_match = re.search(".*(\d+).*$", comment)
        syscall_num = int(com_match.group(1))
        line = line.replace(match.group(0), "")

        # explode the struct members
        line = line.replace("{", "")
        line = line.replace("}", "")
        struct = line.split(",")
        struct = [ x.strip() for x in struct ]

        # now we have the number of args and the name of the call
        syscall_nargs = int(struct[0])
        syscall_name = struct[3].replace("\"", "")

        out.write("\t{\"%s\", 0x80, %d, %d},\n" %
                (syscall_name, syscall_num, syscall_nargs))

    out.write("\t{NULL}\n");
    out.write("};\n\n");
    f.close()

if (__name__ == "__main__"):

    arches = [ "alpha", "arm", "avr32", "bfin", "hppa", "i386", "ia64", "m68k",
            "microblaze", "mips", "powerpc", "s390", "s390x", "sh", "sh64",
            "sparc", "sparc64", "tile", "x86_64"];

    out = open("linux.c", "w")
    out.write("#include \"r_syscall.h\"\n\n")

    for i in arches:
        print("parsing %s" % i)
        gen_map(i, out)

    out.close()