syscall.py 文件源码

def get_ntsyscalls():
    syscalls = set()
    ea = idaapi.str2ea('_KiServiceTable')
    f = idaapi.get_full_long(ea)
    functions = set(idautils.Functions())
    while f in functions:
        fname = GetFunctionName(f)        
        syscalls.add(fname)
        ea += 4
        f = idaapi.get_full_long(ea)
    print 'ntos system call' , len(syscalls)
    return syscalls