Syscall lister

[omega_red]

I have finished (sort of) my little utility that lists all NT syscalls and matches them with appropriate native APIs. Test with care, though, I don't guarantee that it won't crash your system (although I tested it on different machines and OSes).

ry.pl/~omega/progs/syscall.zip

[edit]
Hmm, seems like last build has some problems with obtaining symbols.. I'll check it later :|

[edit]
Fixed. Duh, weirdness of symserv: it creates 2 directories with symbol files, one specified in search path, and the other named "sym". I specified "sym" in the search path, so it prolly conflicted with the second...

[Kayaker]

Nice piece of code omega_red. I like the practical use (exploit?) of MmGetSystemAddressForMdlSafe to grab a copy of the SSDT. It worked fine on both 2K and XP. Because of the long listing I'll just add the reminder that output can be redirected to a text file with
syscall.exe > output.txt

Regards,
Kayaker

[omega_red]

Update: fixed bug in counting parameters.

[omega_red]

Update: after some poking around, I've made 64bit version (AMD64) to work (I think )
You can get it from here: http://ry.pl/~omega/progs/syscall64.zip

BTW: as FASTCALL is the default calling convention in win x64, is it possible to get syscalls parameter info like in win32? I noticed that parameter-info tables are zeroed in win x64.