DIZ

Dynamic SSN Resolver and syscall stub disassembler for windows ntdll.dll using goblin and capstone

cargo run

Then diz.txt should show like

; --- Stub #13 ---
  0x000180160120:  mov      r10, rcx
  0x000180160123:  mov      eax, 6
  0x000180160128:  test     byte ptr [0x7ffe0308], 1
  0x000180160130:  jne      0x180160135

  0x000180160132:  syscall 	; SSN = 6 (0x6) (NtReadFile)

  0x000180160134:  ret      

; --- Stub #14 ---
  0x000180160140:  mov      r10, rcx
  0x000180160143:  mov      eax, 7
  0x000180160148:  test     byte ptr [0x7ffe0308], 1
  0x000180160150:  jne      0x180160155

  0x000180160152:  syscall 	; SSN = 7 (0x7) (NtDeviceIoControlFile)

  0x000180160154:  ret    

Tested on Windows 11 25H2

Thanks

• Syswhisper2
• Syscall table