Struct SyscallEnumerator 

pub struct SyscallEnumerator<'a> { /* private fields */ }

enumerates syscalls from ntdll exports

Implementations

impl<'a> SyscallEnumerator<'a>

pub fn new(ntdll: Module<'a>) -> Self

create enumerator for ntdll

pub fn enumerate(&self) -> Result<Vec<EnumeratedSyscall>>

enumerate all syscalls and their SSNs

pub fn resolve_hooked_ssn(&self, target_addr: usize) -> Option<u16>

resolve SSN using “Halo’s Gate” technique

if a syscall is hooked, look at neighboring syscalls (SSNs are sequential, so Nt* functions nearby have SSN +/- N)