chromium/tools/traceline/traceline/dump_syscalls_idarub.rb

#!/usr/bin/env ruby

# Copyright 2009 The Chromium Authors
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

# This is an idarub script for extracting system call numbers from a DLL that
# has been loaded into the IDA disassembler.  The interesting system call stubs
# are contained in ntdll.dll, user32.dll, gdi32.dll, and imm32.dll.

require 'idarub'

ida, = IdaRub.auto_client

curea = 0

filename = ida.get_root_filename

while true
  curea = ida.find_binary(
      curea, ida.BADADDR, 'ba 00 03 fe 7f', 16, ida.SEARCH_DOWN)
  break if curea == ida.BADADDR

  raise "z" if ida.get_byte(curea - 5) != 0xb8

  syscall = ida.get_long(curea - 4)
  # Remove the IDA _ prefix and the @argsize trailing decorator...
  funcname = ida.get_func_name(curea).split('@', 2)[0].split('_', 2)[-1]
  puts '%d: "%s!%s",' % [syscall, filename, funcname]

  curea += 1
end