I can`t get symbols for lxcore.sys so I just write simple idc scipt. Each item in table has very simple structure:
IDC script to dump syscall table from lxcore.sys:
And table itself
PAGE:00000001C0046620 imul r14, r12, 38h ; size of item in syscall table
PAGE:00000001C0046624 mov r15, rax
PAGE:00000001C0046627 lea rax, lx_ssdt
PAGE:00000001C004662E add r14, rax
PAGE:00000001C0046631 cmp r12, 136h ; count of items in syscall table
PAGE:00000001C0046638 jnb loc_1C00467AE
string with name of method and arguments located at offset 0x10IDC script to dump syscall table from lxcore.sys:
#include <idc.idc>
static main(void)
{
auto addr, name, fp, idx, s_addr;
fp = fopen("lx.dmp", "w");
if ( !fp )
{
return;
}
addr = 0x1C0008110;
for ( idx = 0; idx < 0x136; idx = idx + 1, addr = addr + 0x38 )
{
s_addr = Qword(addr + 0x10);
fprintf(fp, "%X\t", idx);
if ( s_addr != 0 )
{
// dump string
for ( ; ; s_addr = s_addr + 1 )
{
name = Byte(s_addr);
if ( !name )
break;
fprintf(fp, "%c", name);
}
}
fprintf(fp, "\n");
}
fclose(fp);
}
And table itself
0 READ - %u, {%p}, %u
1 WRITE - %d, {%p}, %u
2 OPEN - {%p}, 0x%x, 0x%x
3 CLOSE - %u
4 STAT64 - {%p}, {%p}
5 FSTAT64 - %u, {%p}
6 LSTAT64 - {%p}, {%p}
7 POLL - {%p}, %u, %d
8 LSEEK - %u, %u, %u
9 MMAP - {%p}, 0x%x, %Iu, 0x%x, %d, %Iu
A MPROTECT - {%p}, 0x%x, 0x%x
B MUNMAP - {%p}, 0x%x
C BRK - {%p}
D RT_SIGACTION - %u, {%p}, {%p} %lu
E RT_SIGPROCMASK - %u, {%p}, {%p}, %lu
F RT_SIGRETURN
10 IOCTL - %d, 0x%x, {%p}
11 PREAD64 - %d, {%p}, %u, %u, %u
12 PWRITE64 - %d, {%p}, %u, %u, %u
13 READV - %d, {%p}, %u
14 WRITEV - %d, {%p}, %u
15 ACCESS - {%p}, %u
16 PIPE - {%p}
17 SELECT - %d, {%p}, {%p}, {%p}, {%p}
18 SCHED_YIELD
19 MREMAP - {%p}, 0x%Ix, 0x%Ix, 0x%x, {%p}
1A MSYNC - {%p}, 0x%x, 0x%x
1B
1C MADVISE - {%p}, 0x%x, %u
1D
1E
1F
20 DUP - %u
21 DUP2 - %d, %d
22 PAUSE
23 NANOSLEEP - {%p}, {%p}
24
25
26 SETITIMER %d, {%p}, {%p}
27 GETPID
28
29 SOCKET - %d, %d, %d
2A CONNECT - %d, {%p}, %d
2B ACCEPT - %d, {%p}, {%p}
2C SENDTO - %d, {%p}, %Iu, %d, {%p}, %d
2D RECVFROM - %d, {%p}, %Iu, %d, {%p}, {%p}
2E SENDMSG - %d, {%p}, %d
2F RECVMSG - %d, {%p}, %d
30 SHUTDOWN - %d, %d
31 BIND - %d, {%p}, %d
32 LISTEN - %d, %d
33 GETSOCKNAME - %d, {%p}, {%p}
34 GETPEERNAME (stub) - %d, {%p}, {%p}
35 SOCKETPAIR - %d, %d, %d, {%p}
36 SETSOCKOPT - %d, %d, %d, {%p}, %d
37 GETSOCKOPT - %d, %d, %d, {%p}, {%p}
38 CLONE - 0x%x, {%p}, {%p}, {%p}, {%p}
39 FORK
3A VFORK
3B EXECVE - {%p}, {%p}, {%p}
3C EXIT - %x
3D WAIT4 - %u, {%p}, %u, {%p}
3E KILL - 0x%x, %u
3F NEWUNAME - {%p}
40
41
42
43
44
45
46
47
48 FCNTL64 - %u, %u, 0x%x
49 FLOCK - %u %u
4A FSYNC - %u
4B FDATASYNC - %u
4C TRUNCATE64 - {%p}, %d, %d
4D FTRUNCATE64 - %d, %I64
4E GETDENTS - %d, {%p}, %u
4F GETCWD - {%p}, %u
50 CHDIR - {%p}
51 FCHDIR - %u
52 RENAME - {%p} {%p}
53 MKDIR - {%p}, 0x%x
54 RMDIR - {%p}
55 CREAT - {%p}, 0x%x
56 LINK - {%p}, {%p}
57 UNLINK - {%p}
58 SYMLINK - {%p}, {%p}
59 READLINK (stub) - {%p}, {%p}, %u
5A CHMOD - {%p}, %u
5B FCHMOD - {%d}, %u
5C CHOWN - {%p}, %u, %u
5D FCHOWN - %u, %u, %u
5E LCHOWN - {%p}, %u, %u
5F UMASK - 0%o
60 GETTIMEOFDAY - {%p}, {%p}
61 GETRLIMIT (stub) - %u, {%p}
62 GETRUSAGE%d, {%p}
63 SYSINFO (stub) - {%p}
64 TIMES - {%p}
65 PTRACE (stub) - %u, %u, {%p}, {%p}
66 GETUID
67
68 GETGID
69 SETUID - %u
6A SETGID - %u
6B GETEUID
6C GETEGID
6D SETPGID - %u, %u
6E GETPPID
6F GETPGRP
70 SETSID
71 SETREUID - %u, %u
72 SETREGID - %u, %u
73 GETGROUPS%d, {%p}
74 SETGROUPS (stub) - %u, {%p}
75 SETRESUID - %u, %u, %u
76 GETRESUID - {%p}, {%p}, {%p}
77 SETRESGID - %u, %u, %u
78 GETRESGID - {%p}, {%p}, {%p}
79 GETPGID - 0x%x
7A
7B
7C GETSID - 0x%x
7D CAPGET - {%p}, {%p}
7E CAPSET - {%p}, {%p}
7F RT_SIGPENDING - {%p}, %lu
80 RT_SIGTIMEDWAIT (stub-err) - {%p}, {%p}, {%p}, %lu
81
82 RT_SIGSUSPEND - {%p}, %lu
83 SIGALTSTACK (stub) {%p}, {%p}
84 UTIME - {%p}, {%p}
85 MKNOD (stub) - {%p}, %x, %x
86
87 PERSONALITY - 0x%Ix
88
89 STATFS64 - {%p}, %u, {%p}
8A FSTATFS64- %u %u {%p}
8B
8C GETPRIORITY - %d, %d
8D SETPRIORITY - %d, %d, %d
8E SCHED_SETPARAM - %u, {%p}
8F SCHED_GETPARAM - %u, {%p}
90 SCHED_SETSCHEDULER - %u, %d, {%p}
91 SCHED_GETSCHEDULER - %u
92 SCHED_GET_PRIORITY_MAX - %u
93 SCHED_GET_PRIORITY_MIN - %u
94
95 MLOCK (stub) - {%p}, %u
96 MUNLOCK (stub) - {%p}, %u
97
98
99
9A
9B
9C
9D PRCTL - %u, 0x%x, 0x%x, 0x%x, 0x%x
9E ARCH_PRCTL - %d, {%p}
9F
A0 SETRLIMIT (stub) - %d, {%p}
A1
A2 SYNC
A3
A4 SETTIMEOFDAY - {%p}, {%p}
A5 MOUNT (stub) - {%p}, {%p}, {%p}, 0x%x, {%p}
A6 UMOUNT2 (stub) - {%p}, 0x%x
A7
A8
A9 REBOOT - %x, %x, %d, {%p}
AA
AB
AC
AD
AE
AF
B0
B1
B2
B3
B4
B5
B6
B7
B8
B9
BA GETTID
BB
BC SETXATTR - {%p}, {%p}, {%p}, 0x%x, %d
BD
BE FSETXATTR - %d, {%p}, {%p}, 0x%x, %d
BF GETXATTR(stub) - {%p}, {%p}, {%p}, %Iu
C0
C1
C2
C3
C4
C5
C6
C7
C8 TKILL (stub) - 0x%x, %u
C9 TIME - {%p}
CA FUTEX - {%p}, 0x%x, 0x%x, {%p}, {%p}, 0x%x
CB SCHED_SETAFFINITY (stub) - %u, %u, {%p}
CC
CD SET_THREAD_AREA - {%p}
CE
CF
D0
D1
D2
D3 GET_THREAD_AREA (stub) - {%p}
D4
D5 EPOLL_CREATE - %d
D6
D7
D8
D9 GETDENTS64 - %d, {%p}, %u
DA SET_TID_ADDRESS - {%p}
DB
DC
DD FADVISE64 (stub) - %d, %lld, %lu, %d
DE
DF
E0
E1
E2
E3
E4 CLOCK_GETTIME - %u, {%p}
E5 CLOCK_GETRES - %u, {%p}
E6 CLOCK_NANOSLEEP - %u, 0x%x, {%p}, {%p}
E7 EXIT_GROUP - %x
E8 EPOLL_WAIT - %d, {%p}, %d, %d
E9 EPOLL_CTL - %d, %d, %d, {%p}
EA TGKILL (stub) - 0x%x, 0x%x, %u
EB UTIMES - {%p}, {%p}
EC
ED
EE
EF
F0
F1
F2
F3
F4
F5
F6
F7
F8
F9
FA
FB IOPRIO_SET (stub) - 0x%x 0x%x 0x%x
FC
FD INOTIFY_INIT (stub)
FE INOTIFY_ADD_WATCH (stub) - %u {%p} %d
FF INOTIFY_RM_WATCH (stub) - %u %u
100
101 OPENAT - %u {%p}, 0x%x, 0x%x
102 MKDIRAT - %u, {%p}, 0x%x
103
104 FCHOWNAT - %d, {%p}, %u, %u, %d
105
106 FSTATAT64 - %u {%p} {%p} %u
107 UNLINKAT - %u, {%p}, 0x%x
108
109 LINKAT - %d, {%p}, %d, {%p}, %d
10A
10B
10C FCHMODAT - {%d}, {%p}, %u
10D FACCESSAT - %d, {%p}, %d, %d
10E PSELECT6 - %d, {%p}, {%p}, {%p}, {%p}, {%p}
10F
110 UNSHARE (stub) - 0x%x
111 SET_ROBUST_LIST (stub) - {%p}, %Iu
112 GET_ROBUST_LIST (stub) - %u {%p}, {%p}
113 SPLICE - %u, {%p}, %u, {%p}, %d, %d
114 TEE - %d, %d, %u, %d
115
116
117
118 UTIMENSAT - %u, {%p} {%p} 0x%x
119
11A
11B TIMERFD_CREATE - {%d} {%d}
11C EVENTFD (stub) - 0x%x
11D
11E TIMERFD_SETTIME - {%d}, {%d}, {%p}, {%p}
11F TIMERFD_GETTIME - {%d}, {%p}
120 ACCEPT4 - %d, {%p}, {%p}, %d
121
122 EVENTFD2 (stub) - 0x%x 0x%x
123 EPOLL_CREATE1 - %d
124 DUP3 - %d, %d, %d
125 PIPE2 (stub) - %p %u
126
127
128
129
12A PERF_EVENT_OPEN (stub) - {%p}, %u, %u, %u, 0x%Ix
12B
12C
12D
12E
12F
130
131
132
133 SENDMMSG - %d, {%p}, %u, %u
134
135 GETCPU (stub) - {%p}, {%p}, {%p}