Advertisement
waliedassar

Windows XP (SP2/SP3) SysCall ordinals

Aug 20th, 2012
320
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 9.46 KB | None | 0 0
  1. //http://waleedassar.blogspot.com - (@waleedassar)
  2. #pragma once
  3. //windows XP SP2/XP SP3 - Not finished yet.
  4. char* Names[0x10000]=
  5. {
  6. /*0x0*/   "ZwAcceptConnectPort",
  7. /*0x1*/   "ZwAccessCheck",
  8. /*0x2*/   "ZwAccessCheckAndAuditAlarm",
  9. /*0x3*/   "ZwAccessCheckByType",
  10. /*0x4*/   "ZwAccessCheckByTypeAndAuditAlarm",
  11. /*0x5*/   "ZwAccessCheckByTypeResultList",
  12. /*0x6*/   "ZwAccessCheckByTypeResultListAndAuditAlarm",
  13. /*0x7*/   "ZwAccessCheckByTypeResultListAndAuditAlarmByHandle",
  14. /*0x8*/   "ZwAddAtom",
  15. /*0x9*/   "ZwAddBootEntry",
  16. /*0xA*/   "ZwAdjustGroupsToken",
  17. /*0xB*/   "ZwAdjustPrivilegesToken",
  18. /*0xC*/   "ZwAlertResumeThread",
  19. /*0xD*/   "ZwAlertThread",
  20. /*0xE*/   "ZwAllocateLocallyUniqueId",
  21. /*0xF*/   "ZwAllocateUserPhysicalPages",
  22. /*0x10*/  "ZwAllocateUuids",
  23. /*0x11*/  "ZwAllocateVirtualMemory",
  24. /*0x12*/  "ZwAreMappedFilesTheSame",
  25. /*0x13*/  "ZwAssignProcessToJobObject",
  26. /*0x14*/  "ZwCallbackReturn",
  27. /*0x15*/  "ZwCancelDeviceWakeupRequest",
  28. /*0x16*/  "ZwCancelIoFile",
  29. /*0x17*/  "ZwCancelTimer",
  30. /*0x18*/  "ZwClearEvent",
  31. /*0x19*/  "ZwClose",
  32. /*0x1A*/  "ZwCloseObjectAuditAlarm",
  33. /*0x1B*/  "ZwCompactKeys",
  34. /*0x1C*/  "ZwCompareTokens",
  35. /*0x1D*/  "ZwCompleteConnectPort",
  36. /*0x1E*/  "ZwCompressKey",
  37. /*0x1F*/  "ZwConnectPort",
  38. /*0x20*/  "ZwContinue",
  39. /*0x21*/  "ZwCreateDebugObject",
  40. /*0x22*/  "ZwCreateDirectoryObject",
  41. /*0x23*/  "ZwCreateEvent",
  42. /*0x24*/  "ZwCreateEventPair",
  43. /*0x25*/  "ZwCreateFile",
  44. /*0x26*/  "ZwCreateIoCompletion",
  45. /*0x27*/  "ZwCreateJobObject",
  46. /*0x28*/  "ZwCreateJobSet",
  47. /*0x29*/  "ZwCreateKey",
  48. /*0x2a*/  "ZwCreateMailslotFile",
  49. /*0x2B*/  "ZwCreateMutant",
  50. /*0x2C*/  "ZwCreateNamedPipeFile",
  51. /*0x2D*/  "ZwCreatePagingFile",
  52. /*0x2E*/  "ZwCreatePort",
  53. /*0x2f*/  "ZwCreateProcess",
  54. /*0x30*/  "ZwCreateProcessEx",
  55. /*0x31*/  "ZwCreateProfile",
  56. /*0x32*/  "ZwCreateSection",
  57. /*0x33*/  "ZwCreateSemaphore",
  58. /*0x34*/  "ZwCreateSymbolicLinkObject",
  59. /*0x35*/  "ZwCreateThread",
  60. /*0x36*/  "ZwCreateTimer",
  61. /*0x37*/  "ZwCreateToken",
  62. /*0x38*/  "ZwCreateWaitablePort",
  63. /*0x39*/  "ZwDebugActiveProcess",
  64. /*0x3a*/  "ZwDebugContinue",
  65. /*0x3b*/  "ZwDelayExecution",
  66. /*0x3c*/  "ZwDeleteAtom",
  67. /*0x3d*/  "ZwDeleteBootEntry",
  68. /*0x3e*/  "ZwDeleteFile",
  69. /*0x3f*/  "ZwDeleteKey",
  70. /*0x40*/  "ZwDeleteObjectAuditAlarm",
  71. /*0x41*/  "ZwDeleteValueKey",
  72. /*0x42*/  "ZwDeviceIoControlFile",
  73. /*0x43*/  "ZwDisplayString",
  74. /*0x44*/  "ZwDuplicateObject",
  75. /*0x45*/  "ZwDuplicateToken",
  76. /*0x46*/  "ZwEnumerateBootEntries",
  77. /*0x47*/  "ZwEnumerateKey",
  78. /*0x48*/  "ZwEnumerateSystemEnvironmentValuesEx",
  79. /*0x49*/  "ZwEnumerateValueKey",
  80. /*0x4a*/  "ZwExtendSection",
  81. /*0x4b*/  "ZwFilterToken",
  82. /*0x4c*/  "ZwFindAtom",
  83. /*0x4d*/  "ZwFlushBuffersFile",
  84. /*0x4e*/  "ZwFlushInstructionCache",
  85. /*0x4f*/  "ZwFlushKey",
  86.  
  87.  
  88. /*0x50*/  "ZwFlushVirtualMemory",
  89. /*0x51*/  "ZwFlushWriteBuffer",
  90. /*0x52*/  "ZwFreeUserPhysicalPages",
  91. /*0x53*/  "ZwFreeVirtualMemory",
  92. /*0x54*/  "ZwFsControlFile",
  93. /*0x55*/  "ZwGetContextThread",
  94. /*0x56*/  "ZwGetDevicePowerState",
  95. /*0x57*/  "ZwGetPlugPlayEvent",
  96. /*0x58*/  "ZwGetWriteWatch",
  97. /*0x59*/  "ZwImpersonateAnonymousToken",
  98. /*0x5a*/  "ZwImpersonateClientOfPort",
  99. /*0x5b*/  "ZwImpersonateThread",
  100. /*0x5c*/  "ZwInitializeRegistry",
  101. /*0x5d*/  "ZwInitiatePowerAction",
  102. /*0x5e*/  "ZwIsProcessInJob",
  103. /*0x5f*/  "ZwIsSystemResumeAutomatic",
  104. /*0x60*/  "ZwListenPort",
  105. /*0x61*/  "ZwLoadDriver",
  106. /*0x62*/  "ZwLoadKey",
  107. /*0x63*/  "ZwLoadKey2",
  108. /*0x64*/  "ZwLockFile",
  109. /*0x65*/  "ZwLockProductActivationKeys",
  110. /*0x66*/  "ZwLockRegistryKey",
  111. /*0x67*/  "ZwLockVirtualMemory",
  112. /*0x68*/  "ZwMakePermanentObject",
  113. /*0x69*/  "ZwMakeTemporaryObject",
  114. /*0x6a*/  "ZwMapUserPhysicalPages",
  115. /*0x6b*/  "ZwMapUserPhysicalPagesScatter",
  116. /*0x6c*/  "ZwMapViewOfSection",
  117. /*0x6d*/  "ZwModifyBootEntry",
  118. /*0x6e*/  "ZwNotifyChangeDirectoryFile",
  119. /*0x6f*/  "ZwNotifyChangeKey",
  120. /*0x70*/  "ZwNotifyChangeMultipleKeys",
  121. /*0x71*/  "ZwOpenDirectoryObject",
  122. /*0x72*/  "ZwOpenEvent",
  123. /*0x73*/  "ZwOpenEventPair",
  124. /*0x74*/  "ZwOpenFile",
  125. /*0x75*/  "ZwOpenIoCompletion",
  126. /*0x76*/  "ZwOpenJobObject",
  127. /*0x77*/  "ZwOpenKey",
  128. /*0x78*/  "ZwOpenMutant",
  129. /*0x79*/  "ZwOpenObjectAuditAlarm",
  130. /*0x7a*/  "ZwOpenProcess",
  131. /*0x7b*/  "ZwOpenProcessToken",
  132. /*0x7c*/  "ZwOpenProcessTokenEx",
  133. /*0x7d*/  "ZwOpenSection",
  134. /*0x7e*/  "ZwOpenSemaphore",
  135. /*0x7f*/  "ZwOpenSymbolicLinkObject",
  136.  
  137.  
  138. /*0x80*/  "ZwOpenThread",
  139. /*0x81*/  "ZwOpenThreadToken",
  140. /*0x82*/  "ZwOpenThreadTokenEx",
  141. /*0x83*/  "ZwOpenTimer",
  142. /*0x84*/  "ZwPlugPlayControl",
  143. /*0x85*/  "ZwPowerInformation",
  144. /*0x86*/  "ZwPrivilegeCheck",
  145. /*0x87*/  "ZwPrivilegeObjectAuditAlarm",
  146. /*0x88*/  "ZwPrivilegedServiceAuditAlarm",
  147. /*0x89*/  "ZwProtectVirtualMemory",
  148. /*0x8a*/  "ZwPulseEvent",
  149. /*0x8b*/  "ZwQueryAttributesFile",
  150. /*0x8C*/  "ZwQueryBootEntryOrder",
  151. /*0x8D*/  "ZwQueryBootOptions",
  152. /*0x8e*/  "ZwQueryDebugFilterState",
  153. /*0x8f*/  "ZwQueryDefaultLocale",
  154. /*0x90*/  "ZwQueryDefaultUILanguage",
  155. /*0x91*/  "ZwQueryDirectoryFile",
  156. /*0x92*/  "ZwQueryDirectoryObject",
  157. /*0x93*/  "ZwQueryEaFile",
  158. /*0x94*/  "ZwQueryEvent",
  159. /*0x95*/  "ZwQueryFullAttributesFile",
  160. /*0x96*/  "ZwQueryInformationAtom",
  161. /*0x97*/  "ZwQueryInformationFile",
  162. /*0x98*/  "ZwQueryInformationJobObject",
  163. /*0x99*/  "ZwQueryInformationPort",
  164. /*0x9a*/  "ZwQueryInformationProcess",
  165. /*0x9b*/  "ZwQueryInformationThread",
  166. /*0x9c*/  "ZwQueryInformationToken",
  167. /*0x9d*/  "ZwQueryInstallUILanguage",
  168. /*0x9e*/  "ZwQueryIntervalProfile",
  169. /*0x9f*/  "ZwQueryIoCompletion",
  170. /*0xa0*/  "ZwQueryKey",
  171. /*0xa1*/  "ZwQueryMultipleValueKey",
  172. /*0xa2*/  "ZwQueryMutant",
  173. /*0xa3*/  "ZwQueryObject",
  174. /*0xa4*/  "ZwQueryOpenSubKeys",
  175. /*0xa5*/  "ZwQueryPerformanceCounter",
  176. /*0xa6*/  "ZwQueryQuotaInformationFile",
  177. /*0xa7*/  "ZwQuerySection",
  178. /*0xa8*/  "ZwQuerySecurityObject",
  179. /*0xa9*/  "ZwQuerySemaphore",
  180. /*0xaa*/  "ZwQuerySymbolicLinkObject",
  181. /*0xab*/  "ZwQuerySystemEnvironmentValue",
  182. /*0xac*/  "ZwQuerySystemEnvironmentValueEx",
  183. /*0xad*/  "ZwQuerySystemInformation",
  184. /*0xae*/  "ZwQuerySystemTime",
  185. /*0xaf*/  "ZwQueryTimer",
  186.  
  187. /*0xb0*/  "ZwQueryTimerResolution",
  188. /*0xb1*/  "ZwQueryValueKey",
  189. /*0xb2*/  "ZwQueryVirtualMemory",
  190. /*0xb3*/  "ZwQueryVolumeInformationFile",
  191. /*0xb4*/  "ZwQueueApcThread",
  192. /*0xb5*/  "ZwRaiseException",
  193. /*0xb6*/  "ZwRaiseHardError",
  194. /*0xb7*/  "ZwReadFile",
  195. /*0xb8*/  "ZwReadFileScatter",
  196. /*0xb9*/  "ZwReadRequestData",
  197. /*0xba*/  "ZwReadVirtualMemory",
  198. /*0xbb*/  "ZwRegisterThreadTerminatePort",
  199. /*0xbc*/  "ZwReleaseMutant",
  200. /*0xbd*/  "ZwReleaseSemaphore",
  201. /*0xbe*/  "ZwRemoveIoCompletion",
  202. /*0xbf*/  "ZwRemoveProcessDebug",
  203. /*0xc0*/  "ZwRenameKey",
  204. /*0xc1*/  "ZwReplaceKey",
  205. /*0xc2*/  "ZwReplyPort",
  206. /*0xc3*/  "ZwReplyWaitReceivePort",
  207. /*0xc4*/  "ZwReplyWaitReceivePortEx",
  208. /*0xc5*/  "ZwReplyWaitReplyPort",
  209. /*0xc6*/  "ZwRequestDeviceWakeup",
  210. /*0xc7*/  "ZwRequestPort",
  211. /*0xc8*/  "ZwRequestWaitReplyPort",
  212. /*0xc9*/  "ZwRequestWakeupLatency",
  213. /*0xca*/  "ZwResetEvent",
  214. /*0xcb*/  "ZwResetWriteWatch",
  215. /*0xcc*/  "ZwRestoreKey",
  216. /*0xcd*/  "ZwResumeProcess",
  217. /*0xce*/  "ZwResumeThread",
  218. /*0xcf*/  "ZwSaveKey",
  219. /*0xd0*/  "ZwSaveKeyEx",
  220. /*0xd1*/  "ZwSaveMergedKeys",
  221. /*0xd2*/  "ZwSecureConnectPort",
  222. /*0xd3*/  "ZwSetBootEntryOrder",
  223. /*0xd4*/  "ZwSetBootOptions",
  224. /*0xd5*/  "ZwSetContextThread",
  225. /*0xd6*/  "ZwSetDebugFilterState",
  226. /*0xd7*/  "ZwSetDefaultHardErrorPort",
  227. /*0xd8*/  "ZwSetDefaultLocale",
  228. /*0xd9*/  "ZwSetDefaultUILanguage",
  229. /*0xda*/  "ZwSetEaFile",
  230. /*0xdb*/  "ZwSetEvent",
  231. /*0xdc*/  "ZwSetEventBoostPriority",
  232. /*0xdd*/  "ZwSetHighEventPair",
  233. /*0xde*/  "ZwSetHighWaitLowEventPair",
  234. /*0xdf*/  "ZwSetInformationDebugObject",
  235. /*0xe0*/  "ZwSetInformationFile",
  236. /*0xe1*/  "ZwSetInformationJobObject",
  237. /*0xe2*/  "ZwSetInformationKey",
  238. /*0xe3*/  "ZwSetInformationObject",
  239. /*0xe4*/  "ZwSetInformationProcess",
  240. /*0xe5*/  "ZwSetInformationThread",
  241. /*0xe6*/  "ZwSetInformationToken",
  242. /*0xe7*/  "ZwSetIntervalProfile",
  243. /*0xe8*/  "ZwSetIoCompletion",
  244. /*0xe9*/  "ZwSetLdtEntries",
  245. /*0xea*/  "ZwSetLowEventPair",
  246. /*0xeb*/  "ZwSetLowWaitHighEventPair",
  247. /*0xec*/  "ZwSetQuotaInformationFile",
  248. /*0xed*/  "ZwSetSecurityObject",
  249. /*0xee*/  "ZwSetSystemEnvironmentValue",
  250. /*0xef*/  "ZwSetSystemEnvironmentValueEx",
  251. /*0xf0*/  "ZwSetSystemInformation",
  252. /*0xf1*/  "ZwSetSystemPowerState",
  253. /*0xf2*/  "ZwSetSystemTime",
  254. /*0xf3*/  "ZwSetThreadExecutionState",
  255. /*0xf4*/  "ZwSetTimer",
  256. /*0xf5*/  "ZwSetTimerResolution",
  257. /*0xf6*/  "ZwSetUuidSeed",
  258. /*0xf7*/  "ZwSetValueKey",
  259. /*0xf8*/  "ZwSetVolumeInformationFile",
  260. /*0xf9*/  "ZwShutdownSystem",
  261. /*0xfa*/  "ZwSignalAndWaitForSingleObject",
  262. /*0xfb*/  "ZwStartProfile",
  263. /*0xfc*/  "ZwStopProfile",
  264. /*0xfd*/  "ZwSuspendProcess",
  265. /*0xfe*/  "ZwSuspendThread",
  266. /*0xff*/  "ZwSystemDebugControl",
  267. /*0x100*/ "ZwTerminateJobObject",
  268. /*0x101*/ "ZwTerminateProcess",
  269. /*0x102*/ "ZwTerminateThread",
  270. /*0x103*/ "ZwTestAlert",
  271. /*0x104*/ "ZwTraceEvent",
  272. /*0x105*/ "ZwTranslateFilePath",
  273. /*0x106*/ "ZwUnloadDriver",
  274. /*0x107*/ "ZwUnloadKey",
  275. /*0x108*/ "ZwUnloadKeyEx",
  276. /*0x109*/ "ZwUnlockFile",
  277. /*0x10a*/ "ZwUnlockVirtualMemory",
  278. /*0x10b*/ "ZwUnmapViewOfSection",
  279. /*0x10c*/ "ZwVdmControl",
  280. /*0x10d*/ "ZwWaitForDebugEvent",
  281. /*0x10e*/ "ZwWaitForMultipleObjects",
  282. /*0x10f*/ "ZwWaitForSingleObject",
  283. /*0x110*/ "ZwWaitHighEventPair",
  284. /*0x111*/ "ZwWaitLowEventPair",
  285. /*0x112*/ "ZwWriteFile",
  286. /*0x113*/ "ZwWriteFileGather",
  287. /*0x114*/ "ZwWriteRequestData",
  288. /*0x115*/ "ZwWriteVirtualMemory",
  289. /*0x116*/ "ZwYieldExecution",
  290. /*0x117*/ "ZwCreateKeyedEvent",
  291. /*0x118*/"ZwOpenKeyedEvent",
  292. /*0x119*/"ZwReleaseKeyedEvent",
  293. /*0x11a*/ "ZwWaitForKeyedEvent",
  294. /*0x11b*/ "ZwQueryPortInformationProcess",
  295. /*0x11c*/ "UNKNOWN"
  296. };
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement