Syscall Resolver

Note: Only x64 is supported at this time.

A lightweight x64 C++ library for extracting System Service Numbers (SSNs) and syscall instruction addresses from Windows native DLLs, primarily for use with indirect syscalls.

Features

• Pattern Matching: Scans function prologues for x64 system call instruction patterns (mov r10, rcx, mov eax, SSN, and syscall).
• Simple API: Returns the SSN and syscall address in a single structure.
• Lightweight: Uses standard C++ and Windows API header files with no external dependencies.

API Reference

Data Structures

namespace Resolver {
  struct Structure {
    unsigned long ServiceNumber;   // System Service Number (SSN)
    void*         SyscallAddress;  // Pointer to the 'syscall' instruction in memory
  };
}

Functions

// Resolves the SSN and syscall instruction address for the specified function.
Resolver::Structure* Resolve(HMODULE hModule, LPCSTR szRoutineName);

// Frees memory allocated by Resolve.
void Free(Structure* pStructure);

Example Usage

#ifndef WIN32_LEAN_AND_MEAN
#define WIN32_LEAN_AND_MEAN
#endif

#include <Windows.h>
#include <cstdio>
#include <vector>
#include "resolver.h"

int main() {
    std::vector<const char*> functions = {
        "NtAllocateVirtualMemory",
        "NtFreeVirtualMemory",
        "NtWriteVirtualMemory"
    };

    HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
    if (!hNtdll) {
        printf("Failed to get handle for ntdll.dll\n");
        return 1;
    }

    for (const auto& funcName : functions) {
        Resolver::Structure* pStructure = Resolver::Resolve(hNtdll, funcName);
        if (pStructure) {
            printf("%s -> SSN: 0x%04X | Syscall Address: %p\n",
                   funcName, pStructure->ServiceNumber, pStructure->SyscallAddress);

            Resolver::Free(pStructure);
        }
    }

    return 0;
}

Compile Commands (MVSC / GCC)

MSVC (Developer Command Prompt)

cl.exe /EHsc /W4 main.cpp Resolver/resolver.cpp /Fe:SyscallResolver.exe

GCC

g++ -O2 main.cpp Resolver/resolver.cpp -o SyscallResolver.exe