reknife 1.8.0

A reverse engineer's binary Swiss-army knife: parse, triage, and disassemble PE/ELF/Mach-O. Installs as `knife`.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127

//! Generated by scripts/gen-ntordinals.mjs -- DO NOT EDIT BY HAND.
//!
//! Ordinal -> API mappings for kernel modules whose imports are commonly found
//! as bare ordinals (a stripping pattern in drivers). Sourced from the export
//! directories of the host's own ntoskrnl.exe / ndis.sys during development so
//! every row is a real export, filtered to names the kernel catalog flags.
//! Regenerate with: node scripts/gen-ntordinals.mjs

/// Tuple of (module-base-name, ordinal, api-name).
pub const NT_ORDINALS: &[(&str, u16, &str)] = &[
    ("ndis", 27, "NdisAllocateMemoryWithTagPriority"),
    ("ndis", 28, "NdisAllocateNetBuffer"),
    ("ndis", 29, "NdisAllocateNetBufferAndNetBufferList"),
    ("ndis", 30, "NdisAllocateNetBufferList"),
    ("ndis", 67, "NdisCloseAdapter"),
    ("ndis", 123, "NdisDeregisterProtocol"),
    ("ndis", 124, "NdisDeregisterProtocolDriver"),
    ("ndis", 173, "NdisFreeNetBufferList"),
    ("ndis", 324, "NdisMDeregisterMiniportDriver"),
    ("ndis", 378, "NdisMRegisterMiniportDriver"),
    ("ndis", 429, "NdisOpenAdapter"),
    ("ndis", 466, "NdisRegisterProtocol"),
    ("ndis", 467, "NdisRegisterProtocolDriver"),
    ("ndis", 485, "NdisSendNetBufferLists"),
    ("ntoskrnl", 138, "CmRegisterCallback"),
    ("ntoskrnl", 139, "CmRegisterCallbackEx"),
    ("ntoskrnl", 240, "ExAllocatePool"),
    ("ntoskrnl", 241, "ExAllocatePool2"),
    ("ntoskrnl", 244, "ExAllocatePoolWithQuotaTag"),
    ("ntoskrnl", 245, "ExAllocatePoolWithTag"),
    ("ntoskrnl", 288, "ExFreePool"),
    ("ntoskrnl", 289, "ExFreePool2"),
    ("ntoskrnl", 290, "ExFreePoolWithTag"),
    ("ntoskrnl", 346, "ExQueueWorkItem"),
    ("ntoskrnl", 826, "IoAllocateIrp"),
    ("ntoskrnl", 840, "IoBuildDeviceIoControlRequest"),
    ("ntoskrnl", 843, "IoCallDriver"),
    ("ntoskrnl", 857, "IoCheckShareAccess"),
    ("ntoskrnl", 873, "IoCreateDevice"),
    ("ntoskrnl", 874, "IoCreateDeviceSecure"),
    ("ntoskrnl", 876, "IoCreateDriver"),
    ("ntoskrnl", 878, "IoCreateFile"),
    ("ntoskrnl", 881, "IoCreateNotificationEvent"),
    ("ntoskrnl", 886, "IoCreateSymbolicLink"),
    ("ntoskrnl", 899, "IoDeleteDevice"),
    ("ntoskrnl", 901, "IoDeleteSymbolicLink"),
    ("ntoskrnl", 923, "IoFreeIrp"),
    ("ntoskrnl", 935, "IoGetAttachedDeviceReference"),
    ("ntoskrnl", 949, "IoGetDeviceObjectPointer"),
    ("ntoskrnl", 950, "IoGetDeviceProperty"),
    ("ntoskrnl", 1041, "IoRegisterBootDriverReinitialization"),
    ("ntoskrnl", 1043, "IoRegisterDeviceInterface"),
    ("ntoskrnl", 1045, "IoRegisterDriverReinitialization"),
    ("ntoskrnl", 1088, "IoSetDeviceInterfaceState"),
    ("ntoskrnl", 1166, "IoWMIRegistrationControl"),
    ("ntoskrnl", 1179, "IofCallDriver"),
    ("ntoskrnl", 1254, "KeDelayExecutionThread"),
    ("ntoskrnl", 1306, "KeInitializeEvent"),
    ("ntoskrnl", 1310, "KeInitializeMutex"),
    ("ntoskrnl", 1313, "KeInitializeSemaphore"),
    ("ntoskrnl", 1314, "KeInitializeSpinLock"),
    ("ntoskrnl", 1477, "KeStackAttachProcess"),
    ("ntoskrnl", 1494, "KeUnstackDetachProcess"),
    ("ntoskrnl", 1499, "KeWaitForSingleObject"),
    ("ntoskrnl", 1538, "MmAllocateContiguousMemory"),
    ("ntoskrnl", 1540, "MmAllocateContiguousMemorySpecifyCache"),
    ("ntoskrnl", 1549, "MmAllocatePagesForMdl"),
    ("ntoskrnl", 1560, "MmCopyVirtualMemory"),
    ("ntoskrnl", 1569, "MmFreeContiguousMemory"),
    ("ntoskrnl", 1585, "MmGetSystemRoutineAddress"),
    ("ntoskrnl", 1599, "MmLoadSystemImage"),
    ("ntoskrnl", 1604, "MmMapIoSpace"),
    ("ntoskrnl", 1605, "MmMapIoSpaceEx"),
    ("ntoskrnl", 1606, "MmMapLockedPages"),
    ("ntoskrnl", 1607, "MmMapLockedPagesSpecifyCache"),
    ("ntoskrnl", 1609, "MmMapMdl"),
    ("ntoskrnl", 1627, "MmProbeAndLockPages"),
    ("ntoskrnl", 1652, "MmUnmapIoSpace"),
    ("ntoskrnl", 1653, "MmUnmapLockedPages"),
    ("ntoskrnl", 1818, "ObRegisterCallbacks"),
    ("ntoskrnl", 1823, "ObUnRegisterCallbacks"),
    ("ntoskrnl", 2002, "PsGetProcessImageFileName"),
    ("ntoskrnl", 2066, "PsLookupProcessByProcessId"),
    ("ntoskrnl", 2109, "PsSetCreateProcessNotifyRoutine"),
    ("ntoskrnl", 2110, "PsSetCreateProcessNotifyRoutineEx"),
    ("ntoskrnl", 2112, "PsSetCreateThreadNotifyRoutine"),
    ("ntoskrnl", 2117, "PsSetLoadImageNotifyRoutine"),
    ("ntoskrnl", 2172, "RtlAnsiStringToUnicodeString"),
    ("ntoskrnl", 2234, "RtlCopyUnicodeString"),
    ("ntoskrnl", 2289, "RtlEqualUnicodeString"),
    ("ntoskrnl", 2340, "RtlFreeUnicodeString"),
    ("ntoskrnl", 2385, "RtlGetVersion"),
    ("ntoskrnl", 2403, "RtlInitUnicodeString"),
    ("ntoskrnl", 2532, "RtlPrefixUnicodeString"),
    ("ntoskrnl", 2698, "SeAssignSecurity"),
    ("ntoskrnl", 2758, "SePrivilegeCheck"),
    ("ntoskrnl", 2787, "SeSinglePrivilegeCheck"),
    ("ntoskrnl", 2934, "ZwAllocateVirtualMemory"),
    ("ntoskrnl", 2963, "ZwClose"),
    ("ntoskrnl", 2976, "ZwCreateFile"),
    ("ntoskrnl", 2979, "ZwCreateKey"),
    ("ntoskrnl", 2998, "ZwDeleteKey"),
    ("ntoskrnl", 3026, "ZwLoadDriver"),
    ("ntoskrnl", 3034, "ZwMapViewOfSection"),
    ("ntoskrnl", 3048, "ZwOpenKey"),
    ("ntoskrnl", 3053, "ZwOpenProcess"),
    ("ntoskrnl", 3061, "ZwOpenThread"),
    ("ntoskrnl", 3074, "ZwProtectVirtualMemory"),
    ("ntoskrnl", 3089, "ZwQueryInformationFile"),
    ("ntoskrnl", 3109, "ZwQuerySystemInformation"),
    ("ntoskrnl", 3112, "ZwQueryValueKey"),
    ("ntoskrnl", 3113, "ZwQueryVirtualMemory"),
    ("ntoskrnl", 3117, "ZwReadFile"),
    ("ntoskrnl", 3171, "ZwSetValueKey"),
    ("ntoskrnl", 3178, "ZwTerminateProcess"),
    ("ntoskrnl", 3192, "ZwWriteFile"),
];

/// Resolve an ordinal import 'module!ORDINAL n' to a catalog-known API name.
/// Unknown ordinals fall through to None and keep the synthetic 'ORDINAL N'.
pub fn resolve_ordinal(module: &str, ordinal: u16) -> Option<&'static str> {
    let module = module.to_ascii_lowercase();
    NT_ORDINALS
        .iter()
        .find(|(m, o, _)| *m == module && *o == ordinal)
        .map(|(_, _, n)| *n)
}