-
-
Notifications
You must be signed in to change notification settings - Fork 6
/
r2-syscall-printer.py
777 lines (764 loc) · 86 KB
/
r2-syscall-printer.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
#!/usr/bin/env python3
# r2-syscall-printer v0.5b
# MIT License - Copyright 2020
# David Reguera Garcia aka Dreg - dreg@fr33project.org
# -
# http://github.com/David-Reguera-Garcia-Dreg/ - http://www.fr33project.org/
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
# IN THE SOFTWARE.
# -
# Tables from:
# GEF-extras (syscall-args) - GDB Enhanced Features for exploit devs & reversers
# http://gef.rtfd.io/ - https://github.com/hugsy/gef - https://github.com/hugsy/gef-extras
# -
# usage:
# For 32bit processes inside r2 session use /32: #!pipe python3 r2-syscall-printer.py /32
# Display extra info use /extra:
# #!pipe python3 r2-syscall-printer.py /extra
# #!pipe python3 r2-syscall-printer.py /32 /extra
# -
# WARNING: this is a POC, and the code is pure CRAP
import sys
import pprint
from collections import namedtuple
Entry = namedtuple('Entry', 'name params')
Param = namedtuple('Param', 'reg param')
syscall_table32 = {}
syscall_table32[0x00] = Entry('restart_syscall', [])
syscall_table32[0x01] = Entry('exit', [Param('$ebx', 'int error_code')])
syscall_table32[0x02] = Entry('fork', [])
syscall_table32[0x03] = Entry('read', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'char *buf'), Param('$edx', 'size_t count')])
syscall_table32[0x04] = Entry('write', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'const char *buf'), Param('$edx', 'size_t count')])
syscall_table32[0x05] = Entry('open', [Param('$ebx', 'const char *filename'), Param('$ecx', 'int flags'), Param('$edx', 'umode_t mode')])
syscall_table32[0x06] = Entry('close', [Param('$ebx', 'unsigned int fd')])
syscall_table32[0x07] = Entry('waitpid', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'int *stat_addr'), Param('$edx', 'int options')])
syscall_table32[0x08] = Entry('creat', [Param('$ebx', 'const char *pathname'), Param('$ecx', 'umode_t mode')])
syscall_table32[0x09] = Entry('link', [Param('$ebx', 'const char *oldname'), Param('$ecx', 'const char *newname')])
syscall_table32[0x0a] = Entry('unlink', [Param('$ebx', 'const char *pathname')])
syscall_table32[0x0b] = Entry('execve', [Param('$ebx', 'const char *name'), Param('$ecx', 'const char *const *argv'), Param('$edx', 'const char *const *envp')])
syscall_table32[0x0c] = Entry('chdir', [Param('$ebx', 'const char *filename')])
syscall_table32[0x0d] = Entry('time', [Param('$ebx', 'time_t *tloc')])
syscall_table32[0x0e] = Entry('mknod', [Param('$ebx', 'const char *filename'), Param('$ecx', 'umode_t mode'), Param('$edx', 'unsigned dev')])
syscall_table32[0x0f] = Entry('chmod', [Param('$ebx', 'const char *filename'), Param('$ecx', 'umode_t mode')])
syscall_table32[0x10] = Entry('lchown', [Param('$ebx', 'const char *filename'), Param('$ecx', 'uid_t user'), Param('$edx', 'gid_t group')])
syscall_table32[0x12] = Entry('oldstat', [Param('$ebx', 'const char *filename'), Param('$ecx', 'struct __old_kernel_stat *statbuf')])
syscall_table32[0x13] = Entry('lseek', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'off_t offset'), Param('$edx', 'unsigned int origin')])
syscall_table32[0x14] = Entry('getpid', [])
syscall_table32[0x15] = Entry('mount', [Param('$ebx', 'char *dev_name'), Param('$ecx', 'char *dir_name'), Param('$edx', 'char *type'), Param('$esi', 'unsigned long flags'), Param('$edi', 'void *data')])
syscall_table32[0x16] = Entry('umount', [Param('$ebx', 'char *name'), Param('$ecx', 'int flags')])
syscall_table32[0x17] = Entry('setuid', [Param('$ebx', 'uid_t uid')])
syscall_table32[0x18] = Entry('getuid', [])
syscall_table32[0x19] = Entry('stime', [Param('$ebx', 'time_t *tptr')])
syscall_table32[0x1a] = Entry('ptrace', [Param('$ebx', 'long request'), Param('$ecx', 'long pid'), Param('$edx', 'unsigned long addr'), Param('$esi', 'unsigned long data')])
syscall_table32[0x1b] = Entry('alarm', [Param('$ebx', 'unsigned int seconds')])
syscall_table32[0x1c] = Entry('oldfstat', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'struct __old_kernel_stat *statbuf')])
syscall_table32[0x1d] = Entry('pause', [])
syscall_table32[0x1e] = Entry('utime', [Param('$ebx', 'char *filename'), Param('$ecx', 'struct utimbuf *times')])
syscall_table32[0x21] = Entry('access', [Param('$ebx', 'const char *filename'), Param('$ecx', 'int mode')])
syscall_table32[0x22] = Entry('nice', [Param('$ebx', 'int increment')])
syscall_table32[0x24] = Entry('sync', [])
syscall_table32[0x25] = Entry('kill', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'int sig')])
syscall_table32[0x26] = Entry('rename', [Param('$ebx', 'const char *oldname'), Param('$ecx', 'const char *newname')])
syscall_table32[0x27] = Entry('mkdir', [Param('$ebx', 'const char *pathname'), Param('$ecx', 'umode_t mode')])
syscall_table32[0x28] = Entry('rmdir', [Param('$ebx', 'const char *pathname')])
syscall_table32[0x29] = Entry('dup', [Param('$ebx', 'unsigned int fildes')])
syscall_table32[0x2a] = Entry('pipe', [Param('$ebx', 'int *fildes')])
syscall_table32[0x2b] = Entry('times', [Param('$ebx', 'struct tms *tbuf')])
syscall_table32[0x2d] = Entry('brk', [Param('$ebx', 'unsigned long brk')])
syscall_table32[0x2e] = Entry('setgid', [Param('$ebx', 'gid_t gid')])
syscall_table32[0x2f] = Entry('getgid', [])
syscall_table32[0x30] = Entry('signal', [Param('$ebx', 'int sig'), Param('$ecx', '__sighandler_t handler')])
syscall_table32[0x31] = Entry('geteuid', [])
syscall_table32[0x32] = Entry('getegid', [])
syscall_table32[0x33] = Entry('acct', [Param('$ebx', 'const char *name')])
syscall_table32[0x34] = Entry('umount2', [Param('$ebx', 'char *name'), Param('$ecx', 'int flags')])
syscall_table32[0x36] = Entry('ioctl', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'unsigned int cmd'), Param('$edx', 'unsigned long arg')])
syscall_table32[0x37] = Entry('fcntl', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'unsigned int cmd'), Param('$edx', 'unsigned long arg')])
syscall_table32[0x39] = Entry('setpgid', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'pid_t pgid')])
syscall_table32[0x3b] = Entry('oldolduname', [Param('$ebx', 'struct oldold_utsname *name')])
syscall_table32[0x3c] = Entry('umask', [Param('$ebx', 'int mask')])
syscall_table32[0x3d] = Entry('chroot', [Param('$ebx', 'const char *filename')])
syscall_table32[0x3e] = Entry('ustat', [Param('$ebx', 'unsigned dev'), Param('$ecx', 'struct ustat *ubuf')])
syscall_table32[0x3f] = Entry('dup2', [Param('$ebx', 'unsigned int oldfd'), Param('$ecx', 'unsigned int newfd')])
syscall_table32[0x40] = Entry('getppid', [])
syscall_table32[0x41] = Entry('getpgrp', [])
syscall_table32[0x42] = Entry('setsid', [])
syscall_table32[0x43] = Entry('sigaction', [Param('$ebx', 'int sig'), Param('$ecx', 'const struct old_sigaction *act'), Param('$edx', 'struct old_sigaction *oact')])
syscall_table32[0x44] = Entry('sgetmask', [])
syscall_table32[0x45] = Entry('ssetmask', [Param('$ebx', 'int newmask')])
syscall_table32[0x46] = Entry('setreuid', [Param('$ebx', 'uid_t ruid'), Param('$ecx', 'uid_t euid')])
syscall_table32[0x47] = Entry('setregid', [Param('$ebx', 'gid_t rgid'), Param('$ecx', 'gid_t egid')])
syscall_table32[0x48] = Entry('sigsuspend', [Param('$ebx', 'int history0'), Param('$ecx', 'int history1'), Param('$edx', 'old_sigset_t mask')])
syscall_table32[0x49] = Entry('sigpending', [Param('$ebx', 'old_sigset_t *set')])
syscall_table32[0x4a] = Entry('sethostname', [Param('$ebx', 'char *name'), Param('$ecx', 'int len')])
syscall_table32[0x4b] = Entry('setrlimit', [Param('$ebx', 'unsigned int resource'), Param('$ecx', 'struct rlimit *rlim')])
syscall_table32[0x4c] = Entry('getrlimit', [Param('$ebx', 'unsigned int resource'), Param('$ecx', 'struct rlimit *rlim')])
syscall_table32[0x4d] = Entry('getrusage', [Param('$ebx', 'int who'), Param('$ecx', 'struct rusage *ru')])
syscall_table32[0x4e] = Entry('gettimeofday', [Param('$ebx', 'struct timeval *tv'), Param('$ecx', 'struct timezone *tz')])
syscall_table32[0x4f] = Entry('settimeofday', [Param('$ebx', 'struct timeval *tv'), Param('$ecx', 'struct timezone *tz')])
syscall_table32[0x50] = Entry('getgroups', [Param('$ebx', 'int gidsetsize'), Param('$ecx', 'gid_t *grouplist')])
syscall_table32[0x51] = Entry('setgroups', [Param('$ebx', 'int gidsetsize'), Param('$ecx', 'gid_t *grouplist')])
syscall_table32[0x52] = Entry('select', [Param('$ebx', 'int n'), Param('$ecx', 'fd_set *inp'), Param('$edx', 'fd_set *outp'), Param('$esi', 'fd_set *exp'), Param('$edi', 'struct timeval *tvp')])
syscall_table32[0x53] = Entry('symlink', [Param('$ebx', 'const char *oldname'), Param('$ecx', 'const char *newname')])
syscall_table32[0x54] = Entry('oldlstat', [Param('$ebx', 'const char *filename'), Param('$ecx', 'struct __old_kernel_stat *statbuf')])
syscall_table32[0x55] = Entry('readlink', [Param('$ebx', 'const char *path'), Param('$ecx', 'char *buf'), Param('$edx', 'int bufsiz')])
syscall_table32[0x56] = Entry('uselib', [Param('$ebx', 'const char *library')])
syscall_table32[0x57] = Entry('swapon', [Param('$ebx', 'const char *specialfile'), Param('$ecx', 'int swap_flags')])
syscall_table32[0x58] = Entry('reboot', [Param('$ebx', 'int magic1'), Param('$ecx', 'int magic2'), Param('$edx', 'unsigned int cmd'), Param('$esi', 'void *arg')])
syscall_table32[0x59] = Entry('readdir', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'struct old_linux_dirent *dirent'), Param('$edx', 'unsigned int count')])
syscall_table32[0x5a] = Entry('mmap', [Param('$ebx', 'unsigned long addr'), Param('$ecx', 'unsigned long len'), Param('$edx', 'unsigned long prot'), Param('$esi', 'unsigned long flags'), Param('$edi', 'unsigned long fd'), Param('$ebp', 'unsigned long off')])
syscall_table32[0x5b] = Entry('munmap', [Param('$ebx', 'unsigned long addr'), Param('$ecx', 'size_t len')])
syscall_table32[0x5c] = Entry('truncate', [Param('$ebx', 'const char *path'), Param('$ecx', 'long length')])
syscall_table32[0x5d] = Entry('ftruncate', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'unsigned long length')])
syscall_table32[0x5e] = Entry('fchmod', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'umode_t mode')])
syscall_table32[0x5f] = Entry('fchown', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'uid_t user'), Param('$edx', 'gid_t group')])
syscall_table32[0x60] = Entry('getpriority', [Param('$ebx', 'int which'), Param('$ecx', 'int who')])
syscall_table32[0x61] = Entry('setpriority', [Param('$ebx', 'int which'), Param('$ecx', 'int who'), Param('$edx', 'int niceval')])
syscall_table32[0x63] = Entry('statfs', [Param('$ebx', 'const char *pathname'), Param('$ecx', 'struct statfs *buf')])
syscall_table32[0x64] = Entry('fstatfs', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'struct statfs *buf')])
syscall_table32[0x65] = Entry('ioperm', [Param('$ebx', 'unsigned long from'), Param('$ecx', 'unsigned long num'), Param('$edx', 'int turn_on')])
syscall_table32[0x66] = Entry('socketcall', [Param('$ebx', 'int call'), Param('$ecx', 'unsigned long *args')])
syscall_table32[0x67] = Entry('syslog', [Param('$ebx', 'int type'), Param('$ecx', 'char *buf'), Param('$edx', 'int len')])
syscall_table32[0x68] = Entry('setitimer', [Param('$ebx', 'int which'), Param('$ecx', 'struct itimerval *value'), Param('$edx', 'struct itimerval *ovalue')])
syscall_table32[0x69] = Entry('getitimer', [Param('$ebx', 'int which'), Param('$ecx', 'struct itimerval *value')])
syscall_table32[0x6a] = Entry('stat', [Param('$ebx', 'const char *filename'), Param('$ecx', 'struct __old_kernel_stat *statbuf')])
syscall_table32[0x6b] = Entry('lstat', [Param('$ebx', 'const char *filename'), Param('$ecx', 'struct __old_kernel_stat *statbuf')])
syscall_table32[0x6c] = Entry('fstat', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'struct __old_kernel_stat *statbuf')])
syscall_table32[0x6d] = Entry('olduname', [Param('$ebx', 'struct oldold_utsname *name')])
syscall_table32[0x6e] = Entry('iopl', [Param('$ebx', 'unsigned int level')])
syscall_table32[0x6f] = Entry('vhangup', [])
syscall_table32[0x71] = Entry('vm86old', [Param('$ebx', 'struct vm86_struct *v86')])
syscall_table32[0x72] = Entry('wait4', [Param('$ebx', 'pid_t upid'), Param('$ecx', 'int *stat_addr'), Param('$edx', 'int options'), Param('$esi', 'struct rusage *ru')])
syscall_table32[0x73] = Entry('swapoff', [Param('$ebx', 'const char *specialfile')])
syscall_table32[0x74] = Entry('sysinfo', [Param('$ebx', 'struct sysinfo *info')])
syscall_table32[0x75] = Entry('ipc', [Param('$ebx', 'unsigned int call'), Param('$ecx', 'int first'), Param('$edx', 'unsigned long second'), Param('$esi', 'unsigned long third'), Param('$edi', 'void *ptr'), Param('$ebp', 'long fifth')])
syscall_table32[0x76] = Entry('fsync', [Param('$ebx', 'unsigned int fd')])
syscall_table32[0x77] = Entry('sigreturn', [])
syscall_table32[0x78] = Entry('clone', [Param('$ebx', 'unsigned long clone_flags'), Param('$ecx', 'unsigned long newsp'), Param('$edx', 'void *parent_tid'), Param('$esi', 'void *child_tid')])
syscall_table32[0x79] = Entry('setdomainname', [Param('$ebx', 'char *name'), Param('$ecx', 'int len')])
syscall_table32[0x7a] = Entry('uname', [Param('$ebx', 'struct old_utsname *name')])
syscall_table32[0x7b] = Entry('modify_ldt', [Param('$ebx', 'int func'), Param('$ecx', 'void *ptr'), Param('$edx', 'unsigned long bytecount')])
syscall_table32[0x7c] = Entry('adjtimex', [Param('$ebx', 'struct timex *txc_p')])
syscall_table32[0x7d] = Entry('mprotect', [Param('$ebx', 'unsigned long start'), Param('$ecx', 'size_t len'), Param('$edx', 'unsigned long prot')])
syscall_table32[0x7e] = Entry('sigprocmask', [Param('$ebx', 'int how'), Param('$ecx', 'old_sigset_t *nset'), Param('$edx', 'old_sigset_t *oset')])
syscall_table32[0x80] = Entry('init_module', [Param('$ebx', 'void *umod'), Param('$ecx', 'unsigned long len'), Param('$edx', 'const char *uargs')])
syscall_table32[0x81] = Entry('delete_module', [Param('$ebx', 'const char *name_user'), Param('$ecx', 'unsigned int flags')])
syscall_table32[0x83] = Entry('quotactl', [Param('$ebx', 'unsigned int cmd'), Param('$ecx', 'const char *special'), Param('$edx', 'qid_t id'), Param('$esi', 'void *addr')])
syscall_table32[0x84] = Entry('getpgid', [Param('$ebx', 'pid_t pid')])
syscall_table32[0x85] = Entry('fchdir', [Param('$ebx', 'unsigned int fd')])
syscall_table32[0x86] = Entry('bdflush', [Param('$ebx', 'int func'), Param('$ecx', 'long data')])
syscall_table32[0x87] = Entry('sysfs', [Param('$ebx', 'int option'), Param('$ecx', 'unsigned long arg1'), Param('$edx', 'unsigned long arg2')])
syscall_table32[0x88] = Entry('personality', [Param('$ebx', 'unsigned int personality')])
syscall_table32[0x8a] = Entry('setfsuid', [Param('$ebx', 'uid_t uid')])
syscall_table32[0x8b] = Entry('setfsgid', [Param('$ebx', 'gid_t gid')])
syscall_table32[0x8c] = Entry('_llseek', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'unsigned long offset_high'), Param('$edx', 'unsigned long offset_low'), Param('$esi', 'loff_t *result'), Param('$edi', 'unsigned int origin')])
syscall_table32[0x8d] = Entry('getdents', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'struct linux_dirent *dirent'), Param('$edx', 'unsigned int count')])
syscall_table32[0x8e] = Entry('_newselect', [Param('$ebx', 'int n'), Param('$ecx', 'fd_set *inp'), Param('$edx', 'fd_set *outp'), Param('$esi', 'fd_set *exp'), Param('$edi', 'struct timeval *tvp')])
syscall_table32[0x8f] = Entry('flock', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'unsigned int cmd')])
syscall_table32[0x90] = Entry('msync', [Param('$ebx', 'unsigned long start'), Param('$ecx', 'size_t len'), Param('$edx', 'int flags')])
syscall_table32[0x91] = Entry('readv', [Param('$ebx', 'unsigned long fd'), Param('$ecx', 'const struct iovec *vec'), Param('$edx', 'unsigned long vlen')])
syscall_table32[0x92] = Entry('writev', [Param('$ebx', 'unsigned long fd'), Param('$ecx', 'const struct iovec *vec'), Param('$edx', 'unsigned long vlen')])
syscall_table32[0x93] = Entry('getsid', [Param('$ebx', 'pid_t pid')])
syscall_table32[0x94] = Entry('fdatasync', [Param('$ebx', 'unsigned int fd')])
syscall_table32[0x95] = Entry('_sysctl', [Param('$ebx', 'struct __sysctl_args *args')])
syscall_table32[0x96] = Entry('mlock', [Param('$ebx', 'unsigned long start'), Param('$ecx', 'size_t len')])
syscall_table32[0x97] = Entry('munlock', [Param('$ebx', 'unsigned long start'), Param('$ecx', 'size_t len')])
syscall_table32[0x98] = Entry('mlockall', [Param('$ebx', 'int flags')])
syscall_table32[0x99] = Entry('munlockall', [])
syscall_table32[0x9a] = Entry('sched_setparam', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'struct sched_param *param')])
syscall_table32[0x9b] = Entry('sched_getparam', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'struct sched_param *param')])
syscall_table32[0x9c] = Entry('sched_setscheduler', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'int policy'), Param('$edx', 'struct sched_param *param')])
syscall_table32[0x9d] = Entry('sched_getscheduler', [Param('$ebx', 'pid_t pid')])
syscall_table32[0x9e] = Entry('sched_yield', [])
syscall_table32[0x9f] = Entry('sched_get_priority_max', [Param('$ebx', 'int policy')])
syscall_table32[0xa0] = Entry('sched_get_priority_min', [Param('$ebx', 'int policy')])
syscall_table32[0xa1] = Entry('sched_rr_get_interval', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'struct timespec *interval')])
syscall_table32[0xa2] = Entry('nanosleep', [Param('$ebx', 'struct timespec *rqtp'), Param('$ecx', 'struct timespec *rmtp')])
syscall_table32[0xa3] = Entry('mremap', [Param('$ebx', 'unsigned long addr'), Param('$ecx', 'unsigned long old_len'), Param('$edx', 'unsigned long new_len'), Param('$esi', 'unsigned long flags'), Param('$edi', 'unsigned long new_addr')])
syscall_table32[0xa4] = Entry('setresuid', [Param('$ebx', 'uid_t ruid'), Param('$ecx', 'uid_t euid'), Param('$edx', 'uid_t suid')])
syscall_table32[0xa5] = Entry('getresuid', [Param('$ebx', 'uid_t *ruidp'), Param('$ecx', 'uid_t *euidp'), Param('$edx', 'uid_t *suidp')])
syscall_table32[0xa6] = Entry('vm86', [Param('$ebx', 'unsigned long cmd'), Param('$ecx', 'unsigned long arg')])
syscall_table32[0xa8] = Entry('poll', [Param('$ebx', 'struct pollfd *ufds'), Param('$ecx', 'unsigned int nfds'), Param('$edx', 'int timeout_msecs')])
syscall_table32[0xaa] = Entry('setresgid', [Param('$ebx', 'gid_t rgid'), Param('$ecx', 'gid_t egid'), Param('$edx', 'gid_t sgid')])
syscall_table32[0xab] = Entry('getresgid', [Param('$ebx', 'gid_t *rgidp'), Param('$ecx', 'gid_t *egidp'), Param('$edx', 'gid_t *sgidp')])
syscall_table32[0xac] = Entry('prctl', [Param('$ebx', 'int option'), Param('$ecx', 'unsigned long arg2'), Param('$edx', 'unsigned long arg3'), Param('$esi', 'unsigned long arg4'), Param('$edi', 'unsigned long arg5')])
syscall_table32[0xad] = Entry('rt_sigreturn', [])
syscall_table32[0xae] = Entry('rt_sigaction', [Param('$ebx', 'int sig'), Param('$ecx', 'const struct sigaction *act'), Param('$edx', 'struct sigaction *oact'), Param('$esi', 'size_t sigsetsize')])
syscall_table32[0xaf] = Entry('rt_sigprocmask', [Param('$ebx', 'int how'), Param('$ecx', 'sigset_t *nset'), Param('$edx', 'sigset_t *oset'), Param('$esi', 'size_t sigsetsize')])
syscall_table32[0xb0] = Entry('rt_sigpending', [Param('$ebx', 'sigset_t *set'), Param('$ecx', 'size_t sigsetsize')])
syscall_table32[0xb1] = Entry('rt_sigtimedwait', [Param('$ebx', 'const sigset_t *uthese'), Param('$ecx', 'siginfo_t *uinfo'), Param('$edx', 'const struct timespec *uts'), Param('$esi', 'size_t sigsetsize')])
syscall_table32[0xb2] = Entry('rt_sigqueueinfo', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'int sig'), Param('$edx', 'siginfo_t *uinfo')])
syscall_table32[0xb3] = Entry('rt_sigsuspend', [Param('$ebx', 'sigset_t *unewset'), Param('$ecx', 'size_t sigsetsize')])
syscall_table32[0xb4] = Entry('pread64', [Param('$ebx', 'char *buf size_t count'), Param('$ecx', 'loff_t pos')])
syscall_table32[0xb5] = Entry('pwrite64', [Param('$ebx', 'const char *buf size_t count'), Param('$ecx', 'loff_t pos')])
syscall_table32[0xb6] = Entry('chown', [Param('$ebx', 'const char *filename'), Param('$ecx', 'uid_t user'), Param('$edx', 'gid_t group')])
syscall_table32[0xb7] = Entry('getcwd', [Param('$ebx', 'char *buf'), Param('$ecx', 'unsigned long size')])
syscall_table32[0xb8] = Entry('capget', [Param('$ebx', 'cap_user_header_t header'), Param('$ecx', 'cap_user_data_t dataptr')])
syscall_table32[0xb9] = Entry('capset', [Param('$ebx', 'cap_user_header_t header'), Param('$ecx', 'const cap_user_data_t data')])
syscall_table32[0xba] = Entry('sigaltstack', [Param('$ebx', 'const stack_t *uss'), Param('$ecx', 'stack_t *uoss')])
syscall_table32[0xbb] = Entry('sendfile', [Param('$ebx', 'int out_fd'), Param('$ecx', 'int in_fd'), Param('$edx', 'off_t *offset'), Param('$esi', 'size_t count')])
syscall_table32[0xbe] = Entry('vfork', [])
syscall_table32[0xbf] = Entry('ugetrlimit', [Param('$ebx', 'unsigned int resource'), Param('$ecx', 'struct rlimit *rlim')])
syscall_table32[0xc0] = Entry('mmap2', [Param('$ebx', 'unsigned long addr'), Param('$ecx', 'unsigned long len'), Param('$edx', 'unsigned long prot'), Param('$esi', 'unsigned long flags'), Param('$edi', 'unsigned long fd'), Param('$ebp', 'unsigned long pgoff')])
syscall_table32[0xc1] = Entry('truncate64', [Param('$ebx', 'loff_t length')])
syscall_table32[0xc2] = Entry('ftruncate64', [Param('$ebx', 'loff_t length')])
syscall_table32[0xc3] = Entry('stat64', [Param('$ebx', 'const char *filename'), Param('$ecx', 'struct stat64 *statbuf')])
syscall_table32[0xc4] = Entry('lstat64', [Param('$ebx', 'const char *filename'), Param('$ecx', 'struct stat64 *statbuf')])
syscall_table32[0xc5] = Entry('fstat64', [Param('$ebx', 'unsigned long fd'), Param('$ecx', 'struct stat64 *statbuf')])
syscall_table32[0xc6] = Entry('lchown32', [Param('$ebx', 'const char *filename'), Param('$ecx', 'uid_t user'), Param('$edx', 'gid_t group')])
syscall_table32[0xc7] = Entry('getuid32', [])
syscall_table32[0xc8] = Entry('getgid32', [])
syscall_table32[0xc9] = Entry('geteuid32', [])
syscall_table32[0xca] = Entry('getegid32', [])
syscall_table32[0xcb] = Entry('setreuid32', [Param('$ebx', 'uid_t ruid'), Param('$ecx', 'uid_t euid')])
syscall_table32[0xcc] = Entry('setregid32', [Param('$ebx', 'gid_t rgid'), Param('$ecx', 'gid_t egid')])
syscall_table32[0xcd] = Entry('getgroups32', [Param('$ebx', 'int gidsetsize'), Param('$ecx', 'gid_t *grouplist')])
syscall_table32[0xce] = Entry('setgroups32', [Param('$ebx', 'int gidsetsize'), Param('$ecx', 'gid_t *grouplist')])
syscall_table32[0xcf] = Entry('fchown32', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'uid_t user'), Param('$edx', 'gid_t group')])
syscall_table32[0xd0] = Entry('setresuid32', [Param('$ebx', 'uid_t ruid'), Param('$ecx', 'uid_t euid'), Param('$edx', 'uid_t suid')])
syscall_table32[0xd1] = Entry('getresuid32', [Param('$ebx', 'uid_t *ruidp'), Param('$ecx', 'uid_t *euidp'), Param('$edx', 'uid_t *suidp')])
syscall_table32[0xd2] = Entry('setresgid32', [Param('$ebx', 'gid_t rgid'), Param('$ecx', 'gid_t egid'), Param('$edx', 'gid_t sgid')])
syscall_table32[0xd3] = Entry('getresgid32', [Param('$ebx', 'gid_t *rgidp'), Param('$ecx', 'gid_t *egidp'), Param('$edx', 'gid_t *sgidp')])
syscall_table32[0xd4] = Entry('chown32', [Param('$ebx', 'const char *filename'), Param('$ecx', 'uid_t user'), Param('$edx', 'gid_t group')])
syscall_table32[0xd5] = Entry('setuid32', [Param('$ebx', 'uid_t uid')])
syscall_table32[0xd6] = Entry('setgid32', [Param('$ebx', 'gid_t gid')])
syscall_table32[0xd7] = Entry('setfsuid32', [Param('$ebx', 'uid_t uid')])
syscall_table32[0xd8] = Entry('setfsgid32', [Param('$ebx', 'gid_t gid')])
syscall_table32[0xd9] = Entry('pivot_root', [Param('$ebx', 'const char *new_root'), Param('$ecx', 'const char *put_old')])
syscall_table32[0xda] = Entry('mincore', [Param('$ebx', 'unsigned long start'), Param('$ecx', 'size_t len'), Param('$edx', 'unsigned char *vec')])
syscall_table32[0xdb] = Entry('madvise', [Param('$ebx', 'unsigned long start'), Param('$ecx', 'size_t len_in'), Param('$edx', 'int behavior')])
syscall_table32[0xdc] = Entry('getdents64', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'struct linux_dirent64 *dirent'), Param('$edx', 'unsigned int count')])
syscall_table32[0xdd] = Entry('fcntl64', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'unsigned int cmd'), Param('$edx', 'unsigned long arg')])
syscall_table32[0xe0] = Entry('gettid', [])
syscall_table32[0xe1] = Entry('readahead', [Param('$ebx', 'loff_t offset size_t count')])
syscall_table32[0xe2] = Entry('setxattr', [Param('$ebx', 'const char *pathname'), Param('$ecx', 'const char *name'), Param('$edx', 'const void *value'), Param('$esi', 'size_t size'), Param('$edi', 'int flags')])
syscall_table32[0xe3] = Entry('lsetxattr', [Param('$ebx', 'const char *pathname'), Param('$ecx', 'const char *name'), Param('$edx', 'const void *value'), Param('$esi', 'size_t size'), Param('$edi', 'int flags')])
syscall_table32[0xe4] = Entry('fsetxattr', [Param('$ebx', 'int fd'), Param('$ecx', 'const char *name'), Param('$edx', 'const void *value'), Param('$esi', 'size_t size'), Param('$edi', 'int flags')])
syscall_table32[0xe5] = Entry('getxattr', [Param('$ebx', 'const char *pathname'), Param('$ecx', 'const char *name'), Param('$edx', 'void *value'), Param('$esi', 'size_t size')])
syscall_table32[0xe6] = Entry('lgetxattr', [Param('$ebx', 'const char *pathname'), Param('$ecx', 'const char *name'), Param('$edx', 'void *value'), Param('$esi', 'size_t size')])
syscall_table32[0xe7] = Entry('fgetxattr', [Param('$ebx', 'int fd'), Param('$ecx', 'const char *name'), Param('$edx', 'void *value'), Param('$esi', 'size_t size')])
syscall_table32[0xe8] = Entry('listxattr', [Param('$ebx', 'const char *pathname'), Param('$ecx', 'char *list'), Param('$edx', 'size_t size')])
syscall_table32[0xe9] = Entry('llistxattr', [Param('$ebx', 'const char *pathname'), Param('$ecx', 'char *list'), Param('$edx', 'size_t size')])
syscall_table32[0xea] = Entry('flistxattr', [Param('$ebx', 'int fd'), Param('$ecx', 'char *list'), Param('$edx', 'size_t size')])
syscall_table32[0xeb] = Entry('removexattr', [Param('$ebx', 'const char *pathname'), Param('$ecx', 'const char *name')])
syscall_table32[0xec] = Entry('lremovexattr', [Param('$ebx', 'const char *pathname'), Param('$ecx', 'const char *name')])
syscall_table32[0xed] = Entry('fremovexattr', [Param('$ebx', 'int fd'), Param('$ecx', 'const char *name')])
syscall_table32[0xee] = Entry('tkill', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'int sig')])
syscall_table32[0xef] = Entry('sendfile64', [Param('$ebx', 'int out_fd'), Param('$ecx', 'int in_fd'), Param('$edx', 'loff_t *offset'), Param('$esi', 'size_t count')])
syscall_table32[0xf0] = Entry('futex', [Param('$ebx', 'u32 *uaddr'), Param('$ecx', 'int op'), Param('$edx', 'u32 val'), Param('$esi', 'struct timespec *utime'), Param('$edi', 'u32 *uaddr2'), Param('$ebp', 'u32 val3')])
syscall_table32[0xf1] = Entry('sched_setaffinity', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'unsigned int len'), Param('$edx', 'unsigned long *user_mask_ptr')])
syscall_table32[0xf2] = Entry('sched_getaffinity', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'unsigned int len'), Param('$edx', 'unsigned long *user_mask_ptr')])
syscall_table32[0xf3] = Entry('set_thread_area', [Param('$ebx', 'struct user_desc *u_info')])
syscall_table32[0xf4] = Entry('get_thread_area', [Param('$ebx', 'struct user_desc *u_info')])
syscall_table32[0xf5] = Entry('io_setup', [Param('$ebx', 'unsigned nr_events'), Param('$ecx', 'aio_context_t *ctxp')])
syscall_table32[0xf6] = Entry('io_destroy', [Param('$ebx', 'aio_context_t ctx')])
syscall_table32[0xf7] = Entry('io_getevents', [Param('$ebx', 'aio_context_t ctx_id'), Param('$ecx', 'long min_nr'), Param('$edx', 'long nr'), Param('$esi', 'struct io_event *events'), Param('$edi', 'struct timespec *timeout')])
syscall_table32[0xf8] = Entry('io_submit', [Param('$ebx', 'aio_context_t ctx_id'), Param('$ecx', 'long nr'), Param('$edx', 'struct iocb * *iocbpp')])
syscall_table32[0xf9] = Entry('io_cancel', [Param('$ebx', 'aio_context_t ctx_id'), Param('$ecx', 'struct iocb *iocb'), Param('$edx', 'struct io_event *result')])
syscall_table32[0xfa] = Entry('fadvise64', [Param('$ebx', 'loff_t offset size_t len'), Param('$ecx', 'int advice')])
syscall_table32[0xfc] = Entry('exit_group', [Param('$ebx', 'int error_code')])
syscall_table32[0xfd] = Entry('lookup_dcookie', [Param('$ebx', 'char *buf size_t len')])
syscall_table32[0xfe] = Entry('epoll_create', [Param('$ebx', 'int size')])
syscall_table32[0xff] = Entry('epoll_ctl', [Param('$ebx', 'int epfd'), Param('$ecx', 'int op'), Param('$edx', 'int fd'), Param('$esi', 'struct epoll_event *event')])
syscall_table32[0x100] = Entry('epoll_wait', [Param('$ebx', 'int epfd'), Param('$ecx', 'struct epoll_event *events'), Param('$edx', 'int maxevents'), Param('$esi', 'int timeout')])
syscall_table32[0x101] = Entry('remap_file_pages', [Param('$ebx', 'unsigned long start'), Param('$ecx', 'unsigned long size'), Param('$edx', 'unsigned long prot'), Param('$esi', 'unsigned long pgoff'), Param('$edi', 'unsigned long flags')])
syscall_table32[0x102] = Entry('set_tid_address', [Param('$ebx', 'int *tidptr')])
syscall_table32[0x103] = Entry('timer_create', [Param('$ebx', 'const clockid_t which_clock'), Param('$ecx', 'struct sigevent *timer_event_spec'), Param('$edx', 'timer_t *created_timer_id')])
syscall_table32[0x104] = Entry('timer_settime', [Param('$ebx', 'timer_t timer_id'), Param('$ecx', 'int flags'), Param('$edx', 'const struct itimerspec *new_setting'), Param('$esi', 'struct itimerspec *old_setting')])
syscall_table32[0x105] = Entry('timer_gettime', [Param('$ebx', 'timer_t timer_id'), Param('$ecx', 'struct itimerspec *setting')])
syscall_table32[0x106] = Entry('timer_getoverrun', [Param('$ebx', 'timer_t timer_id')])
syscall_table32[0x107] = Entry('timer_delete', [Param('$ebx', 'timer_t timer_id')])
syscall_table32[0x108] = Entry('clock_settime', [Param('$ebx', 'const clockid_t which_clock'), Param('$ecx', 'const struct timespec *tp')])
syscall_table32[0x109] = Entry('clock_gettime', [Param('$ebx', 'const clockid_t which_clock'), Param('$ecx', 'struct timespec *tp')])
syscall_table32[0x10a] = Entry('clock_getres', [Param('$ebx', 'const clockid_t which_clock'), Param('$ecx', 'struct timespec *tp')])
syscall_table32[0x10b] = Entry('clock_nanosleep', [Param('$ebx', 'const clockid_t which_clock'), Param('$ecx', 'int flags'), Param('$edx', 'const struct timespec *rqtp'), Param('$esi', 'struct timespec *rmtp')])
syscall_table32[0x10c] = Entry('statfs64', [Param('$ebx', 'const char *pathname'), Param('$ecx', 'size_t sz'), Param('$edx', 'struct statfs64 *buf')])
syscall_table32[0x10d] = Entry('fstatfs64', [Param('$ebx', 'unsigned int fd'), Param('$ecx', 'size_t sz'), Param('$edx', 'struct statfs64 *buf')])
syscall_table32[0x10e] = Entry('tgkill', [Param('$ebx', 'pid_t tgid'), Param('$ecx', 'pid_t pid'), Param('$edx', 'int sig')])
syscall_table32[0x10f] = Entry('utimes', [Param('$ebx', 'char *filename'), Param('$ecx', 'struct timeval *utimes')])
syscall_table32[0x110] = Entry('fadvise64_64', [Param('$ebx', 'loff_t offset loff_t len'), Param('$ecx', 'int advice')])
syscall_table32[0x112] = Entry('mbind', [Param('$ebx', 'unsigned long start'), Param('$ecx', 'unsigned long len'), Param('$edx', 'unsigned long mode'), Param('$esi', 'unsigned long *nmask'), Param('$edi', 'unsigned long maxnode'), Param('$ebp', 'unsigned flags')])
syscall_table32[0x113] = Entry('get_mempolicy', [Param('$ebx', 'int *policy'), Param('$ecx', 'unsigned long *nmask'), Param('$edx', 'unsigned long maxnode'), Param('$esi', 'unsigned long addr'), Param('$edi', 'unsigned long flags')])
syscall_table32[0x114] = Entry('set_mempolicy', [Param('$ebx', 'int mode'), Param('$ecx', 'unsigned long *nmask'), Param('$edx', 'unsigned long maxnode')])
syscall_table32[0x115] = Entry('mq_open', [Param('$ebx', 'const char *u_name'), Param('$ecx', 'int oflag'), Param('$edx', 'umode_t mode'), Param('$esi', 'struct mq_attr *u_attr')])
syscall_table32[0x116] = Entry('mq_unlink', [Param('$ebx', 'const char *u_name')])
syscall_table32[0x117] = Entry('mq_timedsend', [Param('$ebx', 'mqd_t mqdes'), Param('$ecx', 'const char *u_msg_ptr'), Param('$edx', 'size_t msg_len'), Param('$esi', 'unsigned int msg_prio'), Param('$edi', 'const struct timespec *u_abs_timeout')])
syscall_table32[0x118] = Entry('mq_timedreceive', [Param('$ebx', 'mqd_t mqdes'), Param('$ecx', 'char *u_msg_ptr'), Param('$edx', 'size_t msg_len'), Param('$esi', 'unsigned int *u_msg_prio'), Param('$edi', 'const struct timespec *u_abs_timeout')])
syscall_table32[0x119] = Entry('mq_notify', [Param('$ebx', 'mqd_t mqdes'), Param('$ecx', 'const struct sigevent *u_notification')])
syscall_table32[0x11a] = Entry('mq_getsetattr', [Param('$ebx', 'mqd_t mqdes'), Param('$ecx', 'const struct mq_attr *u_mqstat'), Param('$edx', 'struct mq_attr *u_omqstat')])
syscall_table32[0x11b] = Entry('kexec_load', [Param('$ebx', 'unsigned long entry'), Param('$ecx', 'unsigned long nr_segments'), Param('$edx', 'struct kexec_segment *segments'), Param('$esi', 'unsigned long flags')])
syscall_table32[0x11c] = Entry('waitid', [Param('$ebx', 'int which'), Param('$ecx', 'pid_t upid'), Param('$edx', 'struct siginfo *infop'), Param('$esi', 'int options'), Param('$edi', 'struct rusage *ru')])
syscall_table32[0x11e] = Entry('add_key', [Param('$ebx', 'const char *_type'), Param('$ecx', 'const char *_description'), Param('$edx', 'const void *_payload'), Param('$esi', 'size_t plen'), Param('$edi', 'key_serial_t ringid')])
syscall_table32[0x11f] = Entry('request_key', [Param('$ebx', 'const char *_type'), Param('$ecx', 'const char *_description'), Param('$edx', 'const char *_callout_info'), Param('$esi', 'key_serial_t destringid')])
syscall_table32[0x120] = Entry('keyctl', [Param('$ebx', 'int option'), Param('$ecx', 'unsigned long arg2'), Param('$edx', 'unsigned long arg3'), Param('$esi', 'unsigned long arg4'), Param('$edi', 'unsigned long arg5')])
syscall_table32[0x121] = Entry('ioprio_set', [Param('$ebx', 'int which'), Param('$ecx', 'int who'), Param('$edx', 'int ioprio')])
syscall_table32[0x122] = Entry('ioprio_get', [Param('$ebx', 'int which'), Param('$ecx', 'int who')])
syscall_table32[0x123] = Entry('inotify_init', [])
syscall_table32[0x124] = Entry('inotify_add_watch', [Param('$ebx', 'int fd'), Param('$ecx', 'const char *pathname'), Param('$edx', 'u32 mask')])
syscall_table32[0x125] = Entry('inotify_rm_watch', [Param('$ebx', 'int fd'), Param('$ecx', '__s32 wd')])
syscall_table32[0x126] = Entry('migrate_pages', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'unsigned long maxnode'), Param('$edx', 'const unsigned long *old_nodes'), Param('$esi', 'const unsigned long *new_nodes')])
syscall_table32[0x127] = Entry('openat', [Param('$ebx', 'int dfd'), Param('$ecx', 'const char *filename'), Param('$edx', 'int flags'), Param('$esi', 'umode_t mode')])
syscall_table32[0x128] = Entry('mkdirat', [Param('$ebx', 'int dfd'), Param('$ecx', 'const char *pathname'), Param('$edx', 'umode_t mode')])
syscall_table32[0x129] = Entry('mknodat', [Param('$ebx', 'int dfd'), Param('$ecx', 'const char *filename'), Param('$edx', 'umode_t mode'), Param('$esi', 'unsigned dev')])
syscall_table32[0x12a] = Entry('fchownat', [Param('$ebx', 'int dfd'), Param('$ecx', 'const char *filename'), Param('$edx', 'uid_t user'), Param('$esi', 'gid_t group'), Param('$edi', 'int flag')])
syscall_table32[0x12b] = Entry('futimesat', [Param('$ebx', 'int dfd'), Param('$ecx', 'const char *filename'), Param('$edx', 'struct timeval *utimes')])
syscall_table32[0x12c] = Entry('fstatat64', [Param('$ebx', 'int dfd'), Param('$ecx', 'const char *filename'), Param('$edx', 'struct stat64 *statbuf'), Param('$esi', 'int flag')])
syscall_table32[0x12d] = Entry('unlinkat', [Param('$ebx', 'int dfd'), Param('$ecx', 'const char *pathname'), Param('$edx', 'int flag')])
syscall_table32[0x12e] = Entry('renameat', [Param('$ebx', 'int olddfd'), Param('$ecx', 'const char *oldname'), Param('$edx', 'int newdfd'), Param('$esi', 'const char *newname')])
syscall_table32[0x12f] = Entry('linkat', [Param('$ebx', 'int olddfd'), Param('$ecx', 'const char *oldname'), Param('$edx', 'int newdfd'), Param('$esi', 'const char *newname'), Param('$edi', 'int flags')])
syscall_table32[0x130] = Entry('symlinkat', [Param('$ebx', 'const char *oldname'), Param('$ecx', 'int newdfd'), Param('$edx', 'const char *newname')])
syscall_table32[0x131] = Entry('readlinkat', [Param('$ebx', 'int dfd'), Param('$ecx', 'const char *pathname'), Param('$edx', 'char *buf'), Param('$esi', 'int bufsiz')])
syscall_table32[0x132] = Entry('fchmodat', [Param('$ebx', 'int dfd'), Param('$ecx', 'const char *filename'), Param('$edx', 'umode_t mode')])
syscall_table32[0x133] = Entry('faccessat', [Param('$ebx', 'int dfd'), Param('$ecx', 'const char *filename'), Param('$edx', 'int mode')])
syscall_table32[0x134] = Entry('pselect6', [Param('$ebx', 'int n'), Param('$ecx', 'fd_set *inp'), Param('$edx', 'fd_set *outp'), Param('$esi', 'fd_set *exp'), Param('$edi', 'struct timespec *tsp'), Param('$ebp', 'void *sig')])
syscall_table32[0x135] = Entry('ppoll', [Param('$ebx', 'struct pollfd *ufds'), Param('$ecx', 'unsigned int nfds'), Param('$edx', 'struct timespec *tsp'), Param('$esi', 'const sigset_t *sigmask'), Param('$edi', 'size_t sigsetsize')])
syscall_table32[0x136] = Entry('unshare', [Param('$ebx', 'unsigned long unshare_flags')])
syscall_table32[0x137] = Entry('set_robust_list', [Param('$ebx', 'struct robust_list_head *head'), Param('$ecx', 'size_t len')])
syscall_table32[0x138] = Entry('get_robust_list', [Param('$ebx', 'int pid'), Param('$ecx', 'struct robust_list_head * *head_ptr'), Param('$edx', 'size_t *len_ptr')])
syscall_table32[0x139] = Entry('splice', [Param('$ebx', 'int fd_in'), Param('$ecx', 'loff_t *off_in'), Param('$edx', 'int fd_out'), Param('$esi', 'loff_t *off_out'), Param('$edi', 'size_t len'), Param('$ebp', 'unsigned int flags')])
syscall_table32[0x13a] = Entry('sync_file_range', [Param('$ebx', 'loff_t offset loff_t nbytes'), Param('$ecx', 'unsigned int flags')])
syscall_table32[0x13b] = Entry('tee', [Param('$ebx', 'int fdin'), Param('$ecx', 'int fdout'), Param('$edx', 'size_t len'), Param('$esi', 'unsigned int flags')])
syscall_table32[0x13c] = Entry('vmsplice', [Param('$ebx', 'int fd'), Param('$ecx', 'const struct iovec *iov'), Param('$edx', 'unsigned long nr_segs'), Param('$esi', 'unsigned int flags')])
syscall_table32[0x13d] = Entry('move_pages', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'unsigned long nr_pages'), Param('$edx', 'const void * *pages'), Param('$esi', 'const int *nodes'), Param('$edi', 'int *status'), Param('$ebp', 'int flags')])
syscall_table32[0x13e] = Entry('getcpu', [Param('$ebx', 'unsigned *cpup'), Param('$ecx', 'unsigned *nodep'), Param('$edx', 'struct getcpu_cache *unused')])
syscall_table32[0x13f] = Entry('epoll_pwait', [Param('$ebx', 'int epfd'), Param('$ecx', 'struct epoll_event *events'), Param('$edx', 'int maxevents'), Param('$esi', 'int timeout'), Param('$edi', 'const sigset_t *sigmask'), Param('$ebp', 'size_t sigsetsize')])
syscall_table32[0x140] = Entry('utimensat', [Param('$ebx', 'int dfd'), Param('$ecx', 'const char *filename'), Param('$edx', 'struct timespec *utimes'), Param('$esi', 'int flags')])
syscall_table32[0x141] = Entry('signalfd', [Param('$ebx', 'int ufd'), Param('$ecx', 'sigset_t *user_mask'), Param('$edx', 'size_t sizemask')])
syscall_table32[0x142] = Entry('timerfd_create', [Param('$ebx', 'int clockid'), Param('$ecx', 'int flags')])
syscall_table32[0x143] = Entry('eventfd', [Param('$ebx', 'unsigned int count')])
syscall_table32[0x144] = Entry('fallocate', [Param('$ebx', 'int mode loff_t offset'), Param('$ecx', 'loff_t len')])
syscall_table32[0x145] = Entry('timerfd_settime', [Param('$ebx', 'int ufd'), Param('$ecx', 'int flags'), Param('$edx', 'const struct itimerspec *utmr'), Param('$esi', 'struct itimerspec *otmr')])
syscall_table32[0x146] = Entry('timerfd_gettime', [Param('$ebx', 'int ufd'), Param('$ecx', 'struct itimerspec *otmr')])
syscall_table32[0x147] = Entry('signalfd4', [Param('$ebx', 'int ufd'), Param('$ecx', 'sigset_t *user_mask'), Param('$edx', 'size_t sizemask'), Param('$esi', 'int flags')])
syscall_table32[0x148] = Entry('eventfd2', [Param('$ebx', 'unsigned int count'), Param('$ecx', 'int flags')])
syscall_table32[0x149] = Entry('epoll_create1', [Param('$ebx', 'int flags')])
syscall_table32[0x14a] = Entry('dup3', [Param('$ebx', 'unsigned int oldfd'), Param('$ecx', 'unsigned int newfd'), Param('$edx', 'int flags')])
syscall_table32[0x14b] = Entry('pipe2', [Param('$ebx', 'int *fildes'), Param('$ecx', 'int flags')])
syscall_table32[0x14c] = Entry('inotify_init1', [Param('$ebx', 'int flags')])
syscall_table32[0x14d] = Entry('preadv', [Param('$ebx', 'unsigned long fd'), Param('$ecx', 'const struct iovec *vec'), Param('$edx', 'unsigned long vlen'), Param('$esi', 'unsigned long pos_l'), Param('$edi', 'unsigned long pos_h')])
syscall_table32[0x14e] = Entry('pwritev', [Param('$ebx', 'unsigned long fd'), Param('$ecx', 'const struct iovec *vec'), Param('$edx', 'unsigned long vlen'), Param('$esi', 'unsigned long pos_l'), Param('$edi', 'unsigned long pos_h')])
syscall_table32[0x14f] = Entry('rt_tgsigqueueinfo', [Param('$ebx', 'pid_t tgid'), Param('$ecx', 'pid_t pid'), Param('$edx', 'int sig'), Param('$esi', 'siginfo_t *uinfo')])
syscall_table32[0x150] = Entry('perf_event_open', [Param('$ebx', 'struct perf_event_attr *attr_uptr'), Param('$ecx', 'pid_t pid'), Param('$edx', 'int cpu'), Param('$esi', 'int group_fd'), Param('$edi', 'unsigned long flags')])
syscall_table32[0x151] = Entry('recvmmsg', [Param('$ebx', 'int fd'), Param('$ecx', 'struct mmsghdr *mmsg'), Param('$edx', 'unsigned int vlen'), Param('$esi', 'unsigned int flags'), Param('$edi', 'struct timespec *timeout')])
syscall_table32[0x152] = Entry('fanotify_init', [Param('$ebx', 'unsigned int flags'), Param('$ecx', 'unsigned int event_f_flags')])
syscall_table32[0x153] = Entry('fanotify_mark', [Param('$ebx', 'unsigned int flags __u64 mask'), Param('$ecx', 'int dfd const char *pathname')])
syscall_table32[0x154] = Entry('prlimit64', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'unsigned int resource'), Param('$edx', 'const struct rlimit64 *new_rlim'), Param('$esi', 'struct rlimit64 *old_rlim')])
syscall_table32[0x155] = Entry('name_to_handle_at', [Param('$ebx', 'int dfd'), Param('$ecx', 'const char *name'), Param('$edx', 'struct file_handle *handle'), Param('$esi', 'int *mnt_id'), Param('$edi', 'int flag')])
syscall_table32[0x156] = Entry('open_by_handle_at', [Param('$ebx', 'int mountdirfd'), Param('$ecx', 'struct file_handle *handle'), Param('$edx', 'int flags')])
syscall_table32[0x157] = Entry('clock_adjtime', [Param('$ebx', 'const clockid_t which_clock'), Param('$ecx', 'struct timex *utx')])
syscall_table32[0x158] = Entry('syncfs', [Param('$ebx', 'int fd')])
syscall_table32[0x159] = Entry('sendmmsg', [Param('$ebx', 'int fd'), Param('$ecx', 'struct mmsghdr *mmsg'), Param('$edx', 'unsigned int vlen'), Param('$esi', 'unsigned int flags')])
syscall_table32[0x15a] = Entry('setns', [Param('$ebx', 'int fd'), Param('$ecx', 'int nstype')])
syscall_table32[0x15b] = Entry('process_vm_readv', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'const struct iovec *lvec'), Param('$edx', 'unsigned long liovcnt'), Param('$esi', 'const struct iovec *rvec'), Param('$edi', 'unsigned long riovcnt'), Param('$ebp', 'unsigned long flags')])
syscall_table32[0x15c] = Entry('process_vm_writev', [Param('$ebx', 'pid_t pid'), Param('$ecx', 'const struct iovec *lvec'), Param('$edx', 'unsigned long liovcnt'), Param('$esi', 'const struct iovec *rvec'), Param('$edi', 'unsigned long riovcnt'), Param('$ebp', 'unsigned long flags')])
syscall_table32[0x15d] = Entry('kcmp', [Param('$ebx', 'pid_t pid1'), Param('$ecx', 'pid_t pid2'), Param('$edx', 'int type'), Param('$esi', 'unsigned long idx1'), Param('$edi', 'unsigned long idx2')])
syscall_table64 = {}
syscall_table64[0x00] = Entry('read', [Param('$rdi', 'unsigned int fd'), Param('$rsi', 'char *buf'), Param('$rdx', 'size_t count')])
syscall_table64[0x01] = Entry('write', [Param('$rdi', 'unsigned int fd'), Param('$rsi', 'const char *buf'), Param('$rdx', 'size_t count')])
syscall_table64[0x02] = Entry('open', [Param('$rdi', 'const char *filename'), Param('$rsi', 'int flags'), Param('$rdx', 'umode_t mode')])
syscall_table64[0x03] = Entry('close', [Param('$rdi', 'unsigned int fd')])
syscall_table64[0x04] = Entry('stat', [Param('$rdi', 'const char *filename'), Param('$rsi', 'struct __old_kernel_stat *statbuf')])
syscall_table64[0x05] = Entry('fstat', [Param('$rdi', 'unsigned int fd'), Param('$rsi', 'struct __old_kernel_stat *statbuf')])
syscall_table64[0x06] = Entry('lstat', [Param('$rdi', 'const char *filename'), Param('$rsi', 'struct __old_kernel_stat *statbuf')])
syscall_table64[0x07] = Entry('poll', [Param('$rdi', 'struct pollfd *ufds'), Param('$rsi', 'unsigned int nfds'), Param('$rdx', 'int timeout_msecs')])
syscall_table64[0x08] = Entry('lseek', [Param('$rdi', 'unsigned int fd'), Param('$rsi', 'off_t offset'), Param('$rdx', 'unsigned int origin')])
syscall_table64[0x09] = Entry('mmap', [Param('$rdi', 'unsigned long addr'), Param('$rsi', 'unsigned long len'), Param('$rdx', 'unsigned long prot'), Param('$r10', 'unsigned long flags'), Param('$r8', 'unsigned long fd'), Param('$r9', 'unsigned long off')])
syscall_table64[0x0a] = Entry('mprotect', [Param('$rdi', 'unsigned long start'), Param('$rsi', 'size_t len'), Param('$rdx', 'unsigned long prot')])
syscall_table64[0x0b] = Entry('munmap', [Param('$rdi', 'unsigned long addr'), Param('$rsi', 'size_t len')])
syscall_table64[0x0c] = Entry('brk', [Param('$rdi', 'unsigned long brk')])
syscall_table64[0x0d] = Entry('rt_sigaction', [Param('$rdi', 'int sig'), Param('$rsi', 'const struct sigaction *act'), Param('$rdx', 'struct sigaction *oact'), Param('$r10', 'size_t sigsetsize')])
syscall_table64[0x0e] = Entry('rt_sigprocmask', [Param('$rdi', 'int how'), Param('$rsi', 'sigset_t *nset'), Param('$rdx', 'sigset_t *oset'), Param('$r10', 'size_t sigsetsize')])
syscall_table64[0x0f] = Entry('rt_sigreturn', [])
syscall_table64[0x10] = Entry('ioctl', [Param('$rdi', 'unsigned int fd'), Param('$rsi', 'unsigned int cmd'), Param('$rdx', 'unsigned long arg')])
syscall_table64[0x11] = Entry('pread64', [Param('$rdi', 'char *buf size_t count'), Param('$rsi', 'loff_t pos')])
syscall_table64[0x12] = Entry('pwrite64', [Param('$rdi', 'const char *buf size_t count'), Param('$rsi', 'loff_t pos')])
syscall_table64[0x13] = Entry('readv', [Param('$rdi', 'unsigned long fd'), Param('$rsi', 'const struct iovec *vec'), Param('$rdx', 'unsigned long vlen')])
syscall_table64[0x14] = Entry('writev', [Param('$rdi', 'unsigned long fd'), Param('$rsi', 'const struct iovec *vec'), Param('$rdx', 'unsigned long vlen')])
syscall_table64[0x15] = Entry('access', [Param('$rdi', 'const char *filename'), Param('$rsi', 'int mode')])
syscall_table64[0x16] = Entry('pipe', [Param('$rdi', 'int *fildes')])
syscall_table64[0x17] = Entry('select', [Param('$rdi', 'int n'), Param('$rsi', 'fd_set *inp'), Param('$rdx', 'fd_set *outp'), Param('$r10', 'fd_set *exp'), Param('$r8', 'struct timeval *tvp')])
syscall_table64[0x18] = Entry('sched_yield', [])
syscall_table64[0x19] = Entry('mremap', [Param('$rdi', 'unsigned long addr'), Param('$rsi', 'unsigned long old_len'), Param('$rdx', 'unsigned long new_len'), Param('$r10', 'unsigned long flags'), Param('$r8', 'unsigned long new_addr')])
syscall_table64[0x1a] = Entry('msync', [Param('$rdi', 'unsigned long start'), Param('$rsi', 'size_t len'), Param('$rdx', 'int flags')])
syscall_table64[0x1b] = Entry('mincore', [Param('$rdi', 'unsigned long start'), Param('$rsi', 'size_t len'), Param('$rdx', 'unsigned char *vec')])
syscall_table64[0x1c] = Entry('madvise', [Param('$rdi', 'unsigned long start'), Param('$rsi', 'size_t len_in'), Param('$rdx', 'int behavior')])
syscall_table64[0x1d] = Entry('shmget', [Param('$rdi', 'key_t key'), Param('$rsi', 'size_t size'), Param('$rdx', 'int shmflg')])
syscall_table64[0x1e] = Entry('shmat', [Param('$rdi', 'int shmid'), Param('$rsi', 'char *shmaddr'), Param('$rdx', 'int shmflg')])
syscall_table64[0x1f] = Entry('shmctl', [Param('$rdi', 'int shmid'), Param('$rsi', 'int cmd'), Param('$rdx', 'struct shmid_ds *buf')])
syscall_table64[0x20] = Entry('dup', [Param('$rdi', 'unsigned int fildes')])
syscall_table64[0x21] = Entry('dup2', [Param('$rdi', 'unsigned int oldfd'), Param('$rsi', 'unsigned int newfd')])
syscall_table64[0x22] = Entry('pause', [])
syscall_table64[0x23] = Entry('nanosleep', [Param('$rdi', 'struct timespec *rqtp'), Param('$rsi', 'struct timespec *rmtp')])
syscall_table64[0x24] = Entry('getitimer', [Param('$rdi', 'int which'), Param('$rsi', 'struct itimerval *value')])
syscall_table64[0x25] = Entry('alarm', [Param('$rdi', 'unsigned int seconds')])
syscall_table64[0x26] = Entry('setitimer', [Param('$rdi', 'int which'), Param('$rsi', 'struct itimerval *value'), Param('$rdx', 'struct itimerval *ovalue')])
syscall_table64[0x27] = Entry('getpid', [])
syscall_table64[0x28] = Entry('sendfile', [Param('$rdi', 'int out_fd'), Param('$rsi', 'int in_fd'), Param('$rdx', 'off_t *offset'), Param('$r10', 'size_t count')])
syscall_table64[0x29] = Entry('socket', [Param('$rdi', 'int family'), Param('$rsi', 'int type'), Param('$rdx', 'int protocol')])
syscall_table64[0x2a] = Entry('connect', [Param('$rdi', 'int fd'), Param('$rsi', 'struct sockaddr *uservaddr'), Param('$rdx', 'int addrlen')])
syscall_table64[0x2b] = Entry('accept', [Param('$rdi', 'int fd'), Param('$rsi', 'struct sockaddr *upeer_sockaddr'), Param('$rdx', 'int *upeer_addrlen')])
syscall_table64[0x2c] = Entry('sendto', [Param('$rdi', 'int fd'), Param('$rsi', 'void *buff'), Param('$rdx', 'size_t len'), Param('$r10', 'unsigned int flags'), Param('$r8', 'struct sockaddr *addr'), Param('$r9', 'int addr_len')])
syscall_table64[0x2d] = Entry('recvfrom', [Param('$rdi', 'int fd'), Param('$rsi', 'void *ubuf'), Param('$rdx', 'size_t size'), Param('$r10', 'unsigned int flags'), Param('$r8', 'struct sockaddr *addr'), Param('$r9', 'int *addr_len')])
syscall_table64[0x2e] = Entry('sendmsg', [Param('$rdi', 'int fd'), Param('$rsi', 'struct msghdr *msg'), Param('$rdx', 'unsigned int flags')])
syscall_table64[0x2f] = Entry('recvmsg', [Param('$rdi', 'int fd'), Param('$rsi', 'struct msghdr *msg'), Param('$rdx', 'unsigned int flags')])
syscall_table64[0x30] = Entry('shutdown', [Param('$rdi', 'int fd'), Param('$rsi', 'int how')])
syscall_table64[0x31] = Entry('bind', [Param('$rdi', 'int fd'), Param('$rsi', 'struct sockaddr *umyaddr'), Param('$rdx', 'int addrlen')])
syscall_table64[0x32] = Entry('listen', [Param('$rdi', 'int fd'), Param('$rsi', 'int backlog')])
syscall_table64[0x33] = Entry('getsockname', [Param('$rdi', 'int fd'), Param('$rsi', 'struct sockaddr *usockaddr'), Param('$rdx', 'int *usockaddr_len')])
syscall_table64[0x34] = Entry('getpeername', [Param('$rdi', 'int fd'), Param('$rsi', 'struct sockaddr *usockaddr'), Param('$rdx', 'int *usockaddr_len')])
syscall_table64[0x35] = Entry('socketpair', [Param('$rdi', 'int family'), Param('$rsi', 'int type'), Param('$rdx', 'int protocol'), Param('$r10', 'int *usockvec')])
syscall_table64[0x36] = Entry('setsockopt', [Param('$rdi', 'int fd'), Param('$rsi', 'int level'), Param('$rdx', 'int optname'), Param('$r10', 'char *optval'), Param('$r8', 'int optlen')])
syscall_table64[0x37] = Entry('getsockopt', [Param('$rdi', 'int fd'), Param('$rsi', 'int level'), Param('$rdx', 'int optname'), Param('$r10', 'char *optval'), Param('$r8', 'int *optlen')])
syscall_table64[0x38] = Entry('clone', [Param('$rdi', 'unsigned long clone_flags'), Param('$rsi', 'unsigned long newsp'), Param('$rdx', 'void *parent_tid'), Param('$r10', 'void *child_tid')])
syscall_table64[0x39] = Entry('fork', [])
syscall_table64[0x3a] = Entry('vfork', [])
syscall_table64[0x3b] = Entry('execve', [Param('$rdi', 'const char *name'), Param('$rsi', 'const char *const *argv'), Param('$rdx', 'const char *const *envp')])
syscall_table64[0x3c] = Entry('exit', [Param('$rdi', 'int error_code')])
syscall_table64[0x3d] = Entry('wait4', [Param('$rdi', 'pid_t upid'), Param('$rsi', 'int *stat_addr'), Param('$rdx', 'int options'), Param('$r10', 'struct rusage *ru')])
syscall_table64[0x3e] = Entry('kill', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'int sig')])
syscall_table64[0x3f] = Entry('uname', [Param('$rdi', 'struct old_utsname *name')])
syscall_table64[0x40] = Entry('semget', [Param('$rdi', 'key_t key'), Param('$rsi', 'int nsems'), Param('$rdx', 'int semflg')])
syscall_table64[0x41] = Entry('semop', [Param('$rdi', 'int semid'), Param('$rsi', 'struct sembuf *tsops'), Param('$rdx', 'unsigned nsops')])
syscall_table64[0x42] = Entry('semctl', [Param('$rdi', 'int semnum int cmd'), Param('$rsi', 'union semun arg')])
syscall_table64[0x43] = Entry('shmdt', [Param('$rdi', 'char *shmaddr')])
syscall_table64[0x44] = Entry('msgget', [Param('$rdi', 'key_t key'), Param('$rsi', 'int msgflg')])
syscall_table64[0x45] = Entry('msgsnd', [Param('$rdi', 'int msqid'), Param('$rsi', 'struct msgbuf *msgp'), Param('$rdx', 'size_t msgsz'), Param('$r10', 'int msgflg')])
syscall_table64[0x46] = Entry('msgrcv', [Param('$rdi', 'int msqid'), Param('$rsi', 'struct msgbuf *msgp'), Param('$rdx', 'size_t msgsz'), Param('$r10', 'long msgtyp'), Param('$r8', 'int msgflg')])
syscall_table64[0x47] = Entry('msgctl', [Param('$rdi', 'int msqid'), Param('$rsi', 'int cmd'), Param('$rdx', 'struct msqid_ds *buf')])
syscall_table64[0x48] = Entry('fcntl', [Param('$rdi', 'unsigned int fd'), Param('$rsi', 'unsigned int cmd'), Param('$rdx', 'unsigned long arg')])
syscall_table64[0x49] = Entry('flock', [Param('$rdi', 'unsigned int fd'), Param('$rsi', 'unsigned int cmd')])
syscall_table64[0x4a] = Entry('fsync', [Param('$rdi', 'unsigned int fd')])
syscall_table64[0x4b] = Entry('fdatasync', [Param('$rdi', 'unsigned int fd')])
syscall_table64[0x4c] = Entry('truncate', [Param('$rdi', 'const char *path'), Param('$rsi', 'long length')])
syscall_table64[0x4d] = Entry('ftruncate', [Param('$rdi', 'unsigned int fd'), Param('$rsi', 'unsigned long length')])
syscall_table64[0x4e] = Entry('getdents', [Param('$rdi', 'unsigned int fd'), Param('$rsi', 'struct linux_dirent *dirent'), Param('$rdx', 'unsigned int count')])
syscall_table64[0x4f] = Entry('getcwd', [Param('$rdi', 'char *buf'), Param('$rsi', 'unsigned long size')])
syscall_table64[0x50] = Entry('chdir', [Param('$rdi', 'const char *filename')])
syscall_table64[0x51] = Entry('fchdir', [Param('$rdi', 'unsigned int fd')])
syscall_table64[0x52] = Entry('rename', [Param('$rdi', 'const char *oldname'), Param('$rsi', 'const char *newname')])
syscall_table64[0x53] = Entry('mkdir', [Param('$rdi', 'const char *pathname'), Param('$rsi', 'umode_t mode')])
syscall_table64[0x54] = Entry('rmdir', [Param('$rdi', 'const char *pathname')])
syscall_table64[0x55] = Entry('creat', [Param('$rdi', 'const char *pathname'), Param('$rsi', 'umode_t mode')])
syscall_table64[0x56] = Entry('link', [Param('$rdi', 'const char *oldname'), Param('$rsi', 'const char *newname')])
syscall_table64[0x57] = Entry('unlink', [Param('$rdi', 'const char *pathname')])
syscall_table64[0x58] = Entry('symlink', [Param('$rdi', 'const char *oldname'), Param('$rsi', 'const char *newname')])
syscall_table64[0x59] = Entry('readlink', [Param('$rdi', 'const char *path'), Param('$rsi', 'char *buf'), Param('$rdx', 'int bufsiz')])
syscall_table64[0x5a] = Entry('chmod', [Param('$rdi', 'const char *filename'), Param('$rsi', 'umode_t mode')])
syscall_table64[0x5b] = Entry('fchmod', [Param('$rdi', 'unsigned int fd'), Param('$rsi', 'umode_t mode')])
syscall_table64[0x5c] = Entry('chown', [Param('$rdi', 'const char *filename'), Param('$rsi', 'uid_t user'), Param('$rdx', 'gid_t group')])
syscall_table64[0x5d] = Entry('fchown', [Param('$rdi', 'unsigned int fd'), Param('$rsi', 'uid_t user'), Param('$rdx', 'gid_t group')])
syscall_table64[0x5e] = Entry('lchown', [Param('$rdi', 'const char *filename'), Param('$rsi', 'uid_t user'), Param('$rdx', 'gid_t group')])
syscall_table64[0x5f] = Entry('umask', [Param('$rdi', 'int mask')])
syscall_table64[0x60] = Entry('gettimeofday', [Param('$rdi', 'struct timeval *tv'), Param('$rsi', 'struct timezone *tz')])
syscall_table64[0x61] = Entry('getrlimit', [Param('$rdi', 'unsigned int resource'), Param('$rsi', 'struct rlimit *rlim')])
syscall_table64[0x62] = Entry('getrusage', [Param('$rdi', 'int who'), Param('$rsi', 'struct rusage *ru')])
syscall_table64[0x63] = Entry('sysinfo', [Param('$rdi', 'struct sysinfo *info')])
syscall_table64[0x64] = Entry('times', [Param('$rdi', 'struct tms *tbuf')])
syscall_table64[0x65] = Entry('ptrace', [Param('$rdi', 'long request'), Param('$rsi', 'long pid'), Param('$rdx', 'unsigned long addr'), Param('$r10', 'unsigned long data')])
syscall_table64[0x66] = Entry('getuid', [])
syscall_table64[0x67] = Entry('syslog', [Param('$rdi', 'int type'), Param('$rsi', 'char *buf'), Param('$rdx', 'int len')])
syscall_table64[0x68] = Entry('getgid', [])
syscall_table64[0x69] = Entry('setuid', [Param('$rdi', 'uid_t uid')])
syscall_table64[0x6a] = Entry('setgid', [Param('$rdi', 'gid_t gid')])
syscall_table64[0x6b] = Entry('geteuid', [])
syscall_table64[0x6c] = Entry('getegid', [])
syscall_table64[0x6d] = Entry('setpgid', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'pid_t pgid')])
syscall_table64[0x6e] = Entry('getppid', [])
syscall_table64[0x6f] = Entry('getpgrp', [])
syscall_table64[0x70] = Entry('setsid', [])
syscall_table64[0x71] = Entry('setreuid', [Param('$rdi', 'uid_t ruid'), Param('$rsi', 'uid_t euid')])
syscall_table64[0x72] = Entry('setregid', [Param('$rdi', 'gid_t rgid'), Param('$rsi', 'gid_t egid')])
syscall_table64[0x73] = Entry('getgroups', [Param('$rdi', 'int gidsetsize'), Param('$rsi', 'gid_t *grouplist')])
syscall_table64[0x74] = Entry('setgroups', [Param('$rdi', 'int gidsetsize'), Param('$rsi', 'gid_t *grouplist')])
syscall_table64[0x75] = Entry('setresuid', [Param('$rdi', 'uid_t ruid'), Param('$rsi', 'uid_t euid'), Param('$rdx', 'uid_t suid')])
syscall_table64[0x76] = Entry('getresuid', [Param('$rdi', 'uid_t *ruidp'), Param('$rsi', 'uid_t *euidp'), Param('$rdx', 'uid_t *suidp')])
syscall_table64[0x77] = Entry('setresgid', [Param('$rdi', 'gid_t rgid'), Param('$rsi', 'gid_t egid'), Param('$rdx', 'gid_t sgid')])
syscall_table64[0x78] = Entry('getresgid', [Param('$rdi', 'gid_t *rgidp'), Param('$rsi', 'gid_t *egidp'), Param('$rdx', 'gid_t *sgidp')])
syscall_table64[0x79] = Entry('getpgid', [Param('$rdi', 'pid_t pid')])
syscall_table64[0x7a] = Entry('setfsuid', [Param('$rdi', 'uid_t uid')])
syscall_table64[0x7b] = Entry('setfsgid', [Param('$rdi', 'gid_t gid')])
syscall_table64[0x7c] = Entry('getsid', [Param('$rdi', 'pid_t pid')])
syscall_table64[0x7d] = Entry('capget', [Param('$rdi', 'cap_user_header_t header'), Param('$rsi', 'cap_user_data_t dataptr')])
syscall_table64[0x7e] = Entry('capset', [Param('$rdi', 'cap_user_header_t header'), Param('$rsi', 'const cap_user_data_t data')])
syscall_table64[0x7f] = Entry('rt_sigpending', [Param('$rdi', 'sigset_t *set'), Param('$rsi', 'size_t sigsetsize')])
syscall_table64[0x80] = Entry('rt_sigtimedwait', [Param('$rdi', 'const sigset_t *uthese'), Param('$rsi', 'siginfo_t *uinfo'), Param('$rdx', 'const struct timespec *uts'), Param('$r10', 'size_t sigsetsize')])
syscall_table64[0x81] = Entry('rt_sigqueueinfo', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'int sig'), Param('$rdx', 'siginfo_t *uinfo')])
syscall_table64[0x82] = Entry('rt_sigsuspend', [Param('$rdi', 'sigset_t *unewset'), Param('$rsi', 'size_t sigsetsize')])
syscall_table64[0x83] = Entry('sigaltstack', [Param('$rdi', 'const stack_t *uss'), Param('$rsi', 'stack_t *uoss')])
syscall_table64[0x84] = Entry('utime', [Param('$rdi', 'char *filename'), Param('$rsi', 'struct utimbuf *times')])
syscall_table64[0x85] = Entry('mknod', [Param('$rdi', 'const char *filename'), Param('$rsi', 'umode_t mode'), Param('$rdx', 'unsigned dev')])
syscall_table64[0x87] = Entry('personality', [Param('$rdi', 'unsigned int personality')])
syscall_table64[0x88] = Entry('ustat', [Param('$rdi', 'unsigned dev'), Param('$rsi', 'struct ustat *ubuf')])
syscall_table64[0x89] = Entry('statfs', [Param('$rdi', 'const char *pathname'), Param('$rsi', 'struct statfs *buf')])
syscall_table64[0x8a] = Entry('fstatfs', [Param('$rdi', 'unsigned int fd'), Param('$rsi', 'struct statfs *buf')])
syscall_table64[0x8b] = Entry('sysfs', [Param('$rdi', 'int option'), Param('$rsi', 'unsigned long arg1'), Param('$rdx', 'unsigned long arg2')])
syscall_table64[0x8c] = Entry('getpriority', [Param('$rdi', 'int which'), Param('$rsi', 'int who')])
syscall_table64[0x8d] = Entry('setpriority', [Param('$rdi', 'int which'), Param('$rsi', 'int who'), Param('$rdx', 'int niceval')])
syscall_table64[0x8e] = Entry('sched_setparam', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'struct sched_param *param')])
syscall_table64[0x8f] = Entry('sched_getparam', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'struct sched_param *param')])
syscall_table64[0x90] = Entry('sched_setscheduler', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'int policy'), Param('$rdx', 'struct sched_param *param')])
syscall_table64[0x91] = Entry('sched_getscheduler', [Param('$rdi', 'pid_t pid')])
syscall_table64[0x92] = Entry('sched_get_priority_max', [Param('$rdi', 'int policy')])
syscall_table64[0x93] = Entry('sched_get_priority_min', [Param('$rdi', 'int policy')])
syscall_table64[0x94] = Entry('sched_rr_get_interval', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'struct timespec *interval')])
syscall_table64[0x95] = Entry('mlock', [Param('$rdi', 'unsigned long start'), Param('$rsi', 'size_t len')])
syscall_table64[0x96] = Entry('munlock', [Param('$rdi', 'unsigned long start'), Param('$rsi', 'size_t len')])
syscall_table64[0x97] = Entry('mlockall', [Param('$rdi', 'int flags')])
syscall_table64[0x98] = Entry('munlockall', [])
syscall_table64[0x99] = Entry('vhangup', [])
syscall_table64[0x9a] = Entry('modify_ldt', [Param('$rdi', 'int func'), Param('$rsi', 'void *ptr'), Param('$rdx', 'unsigned long bytecount')])
syscall_table64[0x9b] = Entry('pivot_root', [Param('$rdi', 'const char *new_root'), Param('$rsi', 'const char *put_old')])
syscall_table64[0x9c] = Entry('_sysctl', [Param('$rdi', 'struct __sysctl_args *args')])
syscall_table64[0x9d] = Entry('prctl', [Param('$rdi', 'int option'), Param('$rsi', 'unsigned long arg2'), Param('$rdx', 'unsigned long arg3'), Param('$r10', 'unsigned long arg4'), Param('$r8', 'unsigned long arg5')])
syscall_table64[0x9e] = Entry('arch_prctl', [Param('$rdi', 'int code'), Param('$rsi', 'unsigned long addr')])
syscall_table64[0x9f] = Entry('adjtimex', [Param('$rdi', 'struct timex *txc_p')])
syscall_table64[0xa0] = Entry('setrlimit', [Param('$rdi', 'unsigned int resource'), Param('$rsi', 'struct rlimit *rlim')])
syscall_table64[0xa1] = Entry('chroot', [Param('$rdi', 'const char *filename')])
syscall_table64[0xa2] = Entry('sync', [])
syscall_table64[0xa3] = Entry('acct', [Param('$rdi', 'const char *name')])
syscall_table64[0xa4] = Entry('settimeofday', [Param('$rdi', 'struct timeval *tv'), Param('$rsi', 'struct timezone *tz')])
syscall_table64[0xa5] = Entry('mount', [Param('$rdi', 'char *dev_name'), Param('$rsi', 'char *dir_name'), Param('$rdx', 'char *type'), Param('$r10', 'unsigned long flags'), Param('$r8', 'void *data')])
syscall_table64[0xa6] = Entry('umount2', [Param('$rdi', 'char *name'), Param('$rsi', 'int flags')])
syscall_table64[0xa7] = Entry('swapon', [Param('$rdi', 'const char *specialfile'), Param('$rsi', 'int swap_flags')])
syscall_table64[0xa8] = Entry('swapoff', [Param('$rdi', 'const char *specialfile')])
syscall_table64[0xa9] = Entry('reboot', [Param('$rdi', 'int magic1'), Param('$rsi', 'int magic2'), Param('$rdx', 'unsigned int cmd'), Param('$r10', 'void *arg')])
syscall_table64[0xaa] = Entry('sethostname', [Param('$rdi', 'char *name'), Param('$rsi', 'int len')])
syscall_table64[0xab] = Entry('setdomainname', [Param('$rdi', 'char *name'), Param('$rsi', 'int len')])
syscall_table64[0xac] = Entry('iopl', [Param('$rdi', 'unsigned int level')])
syscall_table64[0xad] = Entry('ioperm', [Param('$rdi', 'unsigned long from'), Param('$rsi', 'unsigned long num'), Param('$rdx', 'int turn_on')])
syscall_table64[0xaf] = Entry('init_module', [Param('$rdi', 'void *umod'), Param('$rsi', 'unsigned long len'), Param('$rdx', 'const char *uargs')])
syscall_table64[0xb0] = Entry('delete_module', [Param('$rdi', 'const char *name_user'), Param('$rsi', 'unsigned int flags')])
syscall_table64[0xb3] = Entry('quotactl', [Param('$rdi', 'unsigned int cmd'), Param('$rsi', 'const char *special'), Param('$rdx', 'qid_t id'), Param('$r10', 'void *addr')])
syscall_table64[0xba] = Entry('gettid', [])
syscall_table64[0xbb] = Entry('readahead', [Param('$rdi', 'loff_t offset size_t count')])
syscall_table64[0xbc] = Entry('setxattr', [Param('$rdi', 'const char *pathname'), Param('$rsi', 'const char *name'), Param('$rdx', 'const void *value'), Param('$r10', 'size_t size'), Param('$r8', 'int flags')])
syscall_table64[0xbd] = Entry('lsetxattr', [Param('$rdi', 'const char *pathname'), Param('$rsi', 'const char *name'), Param('$rdx', 'const void *value'), Param('$r10', 'size_t size'), Param('$r8', 'int flags')])
syscall_table64[0xbe] = Entry('fsetxattr', [Param('$rdi', 'int fd'), Param('$rsi', 'const char *name'), Param('$rdx', 'const void *value'), Param('$r10', 'size_t size'), Param('$r8', 'int flags')])
syscall_table64[0xbf] = Entry('getxattr', [Param('$rdi', 'const char *pathname'), Param('$rsi', 'const char *name'), Param('$rdx', 'void *value'), Param('$r10', 'size_t size')])
syscall_table64[0xc0] = Entry('lgetxattr', [Param('$rdi', 'const char *pathname'), Param('$rsi', 'const char *name'), Param('$rdx', 'void *value'), Param('$r10', 'size_t size')])
syscall_table64[0xc1] = Entry('fgetxattr', [Param('$rdi', 'int fd'), Param('$rsi', 'const char *name'), Param('$rdx', 'void *value'), Param('$r10', 'size_t size')])
syscall_table64[0xc2] = Entry('listxattr', [Param('$rdi', 'const char *pathname'), Param('$rsi', 'char *list'), Param('$rdx', 'size_t size')])
syscall_table64[0xc3] = Entry('llistxattr', [Param('$rdi', 'const char *pathname'), Param('$rsi', 'char *list'), Param('$rdx', 'size_t size')])
syscall_table64[0xc4] = Entry('flistxattr', [Param('$rdi', 'int fd'), Param('$rsi', 'char *list'), Param('$rdx', 'size_t size')])
syscall_table64[0xc5] = Entry('removexattr', [Param('$rdi', 'const char *pathname'), Param('$rsi', 'const char *name')])
syscall_table64[0xc6] = Entry('lremovexattr', [Param('$rdi', 'const char *pathname'), Param('$rsi', 'const char *name')])
syscall_table64[0xc7] = Entry('fremovexattr', [Param('$rdi', 'int fd'), Param('$rsi', 'const char *name')])
syscall_table64[0xc8] = Entry('tkill', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'int sig')])
syscall_table64[0xc9] = Entry('time', [Param('$rdi', 'time_t *tloc')])
syscall_table64[0xca] = Entry('futex', [Param('$rdi', 'u32 *uaddr'), Param('$rsi', 'int op'), Param('$rdx', 'u32 val'), Param('$r10', 'struct timespec *utime'), Param('$r8', 'u32 *uaddr2'), Param('$r9', 'u32 val3')])
syscall_table64[0xcb] = Entry('sched_setaffinity', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'unsigned int len'), Param('$rdx', 'unsigned long *user_mask_ptr')])
syscall_table64[0xcc] = Entry('sched_getaffinity', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'unsigned int len'), Param('$rdx', 'unsigned long *user_mask_ptr')])
syscall_table64[0xce] = Entry('io_setup', [Param('$rdi', 'unsigned nr_events'), Param('$rsi', 'aio_context_t *ctxp')])
syscall_table64[0xcf] = Entry('io_destroy', [Param('$rdi', 'aio_context_t ctx')])
syscall_table64[0xd0] = Entry('io_getevents', [Param('$rdi', 'aio_context_t ctx_id'), Param('$rsi', 'long min_nr'), Param('$rdx', 'long nr'), Param('$r10', 'struct io_event *events'), Param('$r8', 'struct timespec *timeout')])
syscall_table64[0xd1] = Entry('io_submit', [Param('$rdi', 'aio_context_t ctx_id'), Param('$rsi', 'long nr'), Param('$rdx', 'struct iocb * *iocbpp')])
syscall_table64[0xd2] = Entry('io_cancel', [Param('$rdi', 'aio_context_t ctx_id'), Param('$rsi', 'struct iocb *iocb'), Param('$rdx', 'struct io_event *result')])
syscall_table64[0xd4] = Entry('lookup_dcookie', [Param('$rdi', 'char *buf size_t len')])
syscall_table64[0xd5] = Entry('epoll_create', [Param('$rdi', 'int size')])
syscall_table64[0xd8] = Entry('remap_file_pages', [Param('$rdi', 'unsigned long start'), Param('$rsi', 'unsigned long size'), Param('$rdx', 'unsigned long prot'), Param('$r10', 'unsigned long pgoff'), Param('$r8', 'unsigned long flags')])
syscall_table64[0xd9] = Entry('getdents64', [Param('$rdi', 'unsigned int fd'), Param('$rsi', 'struct linux_dirent64 *dirent'), Param('$rdx', 'unsigned int count')])
syscall_table64[0xda] = Entry('set_tid_address', [Param('$rdi', 'int *tidptr')])
syscall_table64[0xdb] = Entry('restart_syscall', [])
syscall_table64[0xdc] = Entry('semtimedop', [Param('$rdi', 'int semid'), Param('$rsi', 'struct sembuf *tsops'), Param('$rdx', 'unsigned nsops'), Param('$r10', 'const struct timespec *timeout')])
syscall_table64[0xdd] = Entry('fadvise64', [Param('$rdi', 'loff_t offset size_t len'), Param('$rsi', 'int advice')])
syscall_table64[0xde] = Entry('timer_create', [Param('$rdi', 'const clockid_t which_clock'), Param('$rsi', 'struct sigevent *timer_event_spec'), Param('$rdx', 'timer_t *created_timer_id')])
syscall_table64[0xdf] = Entry('timer_settime', [Param('$rdi', 'timer_t timer_id'), Param('$rsi', 'int flags'), Param('$rdx', 'const struct itimerspec *new_setting'), Param('$r10', 'struct itimerspec *old_setting')])
syscall_table64[0xe0] = Entry('timer_gettime', [Param('$rdi', 'timer_t timer_id'), Param('$rsi', 'struct itimerspec *setting')])
syscall_table64[0xe1] = Entry('timer_getoverrun', [Param('$rdi', 'timer_t timer_id')])
syscall_table64[0xe2] = Entry('timer_delete', [Param('$rdi', 'timer_t timer_id')])
syscall_table64[0xe3] = Entry('clock_settime', [Param('$rdi', 'const clockid_t which_clock'), Param('$rsi', 'const struct timespec *tp')])
syscall_table64[0xe4] = Entry('clock_gettime', [Param('$rdi', 'const clockid_t which_clock'), Param('$rsi', 'struct timespec *tp')])
syscall_table64[0xe5] = Entry('clock_getres', [Param('$rdi', 'const clockid_t which_clock'), Param('$rsi', 'struct timespec *tp')])
syscall_table64[0xe6] = Entry('clock_nanosleep', [Param('$rdi', 'const clockid_t which_clock'), Param('$rsi', 'int flags'), Param('$rdx', 'const struct timespec *rqtp'), Param('$r10', 'struct timespec *rmtp')])
syscall_table64[0xe7] = Entry('exit_group', [Param('$rdi', 'int error_code')])
syscall_table64[0xe8] = Entry('epoll_wait', [Param('$rdi', 'int epfd'), Param('$rsi', 'struct epoll_event *events'), Param('$rdx', 'int maxevents'), Param('$r10', 'int timeout')])
syscall_table64[0xe9] = Entry('epoll_ctl', [Param('$rdi', 'int epfd'), Param('$rsi', 'int op'), Param('$rdx', 'int fd'), Param('$r10', 'struct epoll_event *event')])
syscall_table64[0xea] = Entry('tgkill', [Param('$rdi', 'pid_t tgid'), Param('$rsi', 'pid_t pid'), Param('$rdx', 'int sig')])
syscall_table64[0xeb] = Entry('utimes', [Param('$rdi', 'char *filename'), Param('$rsi', 'struct timeval *utimes')])
syscall_table64[0xed] = Entry('mbind', [Param('$rdi', 'unsigned long start'), Param('$rsi', 'unsigned long len'), Param('$rdx', 'unsigned long mode'), Param('$r10', 'unsigned long *nmask'), Param('$r8', 'unsigned long maxnode'), Param('$r9', 'unsigned flags')])
syscall_table64[0xee] = Entry('set_mempolicy', [Param('$rdi', 'int mode'), Param('$rsi', 'unsigned long *nmask'), Param('$rdx', 'unsigned long maxnode')])
syscall_table64[0xef] = Entry('get_mempolicy', [Param('$rdi', 'int *policy'), Param('$rsi', 'unsigned long *nmask'), Param('$rdx', 'unsigned long maxnode'), Param('$r10', 'unsigned long addr'), Param('$r8', 'unsigned long flags')])
syscall_table64[0xf0] = Entry('mq_open', [Param('$rdi', 'const char *u_name'), Param('$rsi', 'int oflag'), Param('$rdx', 'umode_t mode'), Param('$r10', 'struct mq_attr *u_attr')])
syscall_table64[0xf1] = Entry('mq_unlink', [Param('$rdi', 'const char *u_name')])
syscall_table64[0xf2] = Entry('mq_timedsend', [Param('$rdi', 'mqd_t mqdes'), Param('$rsi', 'const char *u_msg_ptr'), Param('$rdx', 'size_t msg_len'), Param('$r10', 'unsigned int msg_prio'), Param('$r8', 'const struct timespec *u_abs_timeout')])
syscall_table64[0xf3] = Entry('mq_timedreceive', [Param('$rdi', 'mqd_t mqdes'), Param('$rsi', 'char *u_msg_ptr'), Param('$rdx', 'size_t msg_len'), Param('$r10', 'unsigned int *u_msg_prio'), Param('$r8', 'const struct timespec *u_abs_timeout')])
syscall_table64[0xf4] = Entry('mq_notify', [Param('$rdi', 'mqd_t mqdes'), Param('$rsi', 'const struct sigevent *u_notification')])
syscall_table64[0xf5] = Entry('mq_getsetattr', [Param('$rdi', 'mqd_t mqdes'), Param('$rsi', 'const struct mq_attr *u_mqstat'), Param('$rdx', 'struct mq_attr *u_omqstat')])
syscall_table64[0xf6] = Entry('kexec_load', [Param('$rdi', 'unsigned long entry'), Param('$rsi', 'unsigned long nr_segments'), Param('$rdx', 'struct kexec_segment *segments'), Param('$r10', 'unsigned long flags')])
syscall_table64[0xf7] = Entry('waitid', [Param('$rdi', 'int which'), Param('$rsi', 'pid_t upid'), Param('$rdx', 'struct siginfo *infop'), Param('$r10', 'int options'), Param('$r8', 'struct rusage *ru')])
syscall_table64[0xf8] = Entry('add_key', [Param('$rdi', 'const char *_type'), Param('$rsi', 'const char *_description'), Param('$rdx', 'const void *_payload'), Param('$r10', 'size_t plen'), Param('$r8', 'key_serial_t ringid')])
syscall_table64[0xf9] = Entry('request_key', [Param('$rdi', 'const char *_type'), Param('$rsi', 'const char *_description'), Param('$rdx', 'const char *_callout_info'), Param('$r10', 'key_serial_t destringid')])
syscall_table64[0xfa] = Entry('keyctl', [Param('$rdi', 'int option'), Param('$rsi', 'unsigned long arg2'), Param('$rdx', 'unsigned long arg3'), Param('$r10', 'unsigned long arg4'), Param('$r8', 'unsigned long arg5')])
syscall_table64[0xfb] = Entry('ioprio_set', [Param('$rdi', 'int which'), Param('$rsi', 'int who'), Param('$rdx', 'int ioprio')])
syscall_table64[0xfc] = Entry('ioprio_get', [Param('$rdi', 'int which'), Param('$rsi', 'int who')])
syscall_table64[0xfd] = Entry('inotify_init', [])
syscall_table64[0xfe] = Entry('inotify_add_watch', [Param('$rdi', 'int fd'), Param('$rsi', 'const char *pathname'), Param('$rdx', 'u32 mask')])
syscall_table64[0xff] = Entry('inotify_rm_watch', [Param('$rdi', 'int fd'), Param('$rsi', '__s32 wd')])
syscall_table64[0x100] = Entry('migrate_pages', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'unsigned long maxnode'), Param('$rdx', 'const unsigned long *old_nodes'), Param('$r10', 'const unsigned long *new_nodes')])
syscall_table64[0x101] = Entry('openat', [Param('$rdi', 'int dfd'), Param('$rsi', 'const char *filename'), Param('$rdx', 'int flags'), Param('$r10', 'umode_t mode')])
syscall_table64[0x102] = Entry('mkdirat', [Param('$rdi', 'int dfd'), Param('$rsi', 'const char *pathname'), Param('$rdx', 'umode_t mode')])
syscall_table64[0x103] = Entry('mknodat', [Param('$rdi', 'int dfd'), Param('$rsi', 'const char *filename'), Param('$rdx', 'umode_t mode'), Param('$r10', 'unsigned dev')])
syscall_table64[0x104] = Entry('fchownat', [Param('$rdi', 'int dfd'), Param('$rsi', 'const char *filename'), Param('$rdx', 'uid_t user'), Param('$r10', 'gid_t group'), Param('$r8', 'int flag')])
syscall_table64[0x105] = Entry('futimesat', [Param('$rdi', 'int dfd'), Param('$rsi', 'const char *filename'), Param('$rdx', 'struct timeval *utimes')])
syscall_table64[0x106] = Entry('newfstatat', [Param('$rdi', 'int dfd'), Param('$rsi', 'const char *filename'), Param('$rdx', 'struct stat *statbuf'), Param('$r10', 'int flag')])
syscall_table64[0x107] = Entry('unlinkat', [Param('$rdi', 'int dfd'), Param('$rsi', 'const char *pathname'), Param('$rdx', 'int flag')])
syscall_table64[0x108] = Entry('renameat', [Param('$rdi', 'int olddfd'), Param('$rsi', 'const char *oldname'), Param('$rdx', 'int newdfd'), Param('$r10', 'const char *newname')])
syscall_table64[0x109] = Entry('linkat', [Param('$rdi', 'int olddfd'), Param('$rsi', 'const char *oldname'), Param('$rdx', 'int newdfd'), Param('$r10', 'const char *newname'), Param('$r8', 'int flags')])
syscall_table64[0x10a] = Entry('symlinkat', [Param('$rdi', 'const char *oldname'), Param('$rsi', 'int newdfd'), Param('$rdx', 'const char *newname')])
syscall_table64[0x10b] = Entry('readlinkat', [Param('$rdi', 'int dfd'), Param('$rsi', 'const char *pathname'), Param('$rdx', 'char *buf'), Param('$r10', 'int bufsiz')])
syscall_table64[0x10c] = Entry('fchmodat', [Param('$rdi', 'int dfd'), Param('$rsi', 'const char *filename'), Param('$rdx', 'umode_t mode')])
syscall_table64[0x10d] = Entry('faccessat', [Param('$rdi', 'int dfd'), Param('$rsi', 'const char *filename'), Param('$rdx', 'int mode')])
syscall_table64[0x10e] = Entry('pselect6', [Param('$rdi', 'int n'), Param('$rsi', 'fd_set *inp'), Param('$rdx', 'fd_set *outp'), Param('$r10', 'fd_set *exp'), Param('$r8', 'struct timespec *tsp'), Param('$r9', 'void *sig')])
syscall_table64[0x10f] = Entry('ppoll', [Param('$rdi', 'struct pollfd *ufds'), Param('$rsi', 'unsigned int nfds'), Param('$rdx', 'struct timespec *tsp'), Param('$r10', 'const sigset_t *sigmask'), Param('$r8', 'size_t sigsetsize')])
syscall_table64[0x110] = Entry('unshare', [Param('$rdi', 'unsigned long unshare_flags')])
syscall_table64[0x111] = Entry('set_robust_list', [Param('$rdi', 'struct robust_list_head *head'), Param('$rsi', 'size_t len')])
syscall_table64[0x112] = Entry('get_robust_list', [Param('$rdi', 'int pid'), Param('$rsi', 'struct robust_list_head * *head_ptr'), Param('$rdx', 'size_t *len_ptr')])
syscall_table64[0x113] = Entry('splice', [Param('$rdi', 'int fd_in'), Param('$rsi', 'loff_t *off_in'), Param('$rdx', 'int fd_out'), Param('$r10', 'loff_t *off_out'), Param('$r8', 'size_t len'), Param('$r9', 'unsigned int flags')])
syscall_table64[0x114] = Entry('tee', [Param('$rdi', 'int fdin'), Param('$rsi', 'int fdout'), Param('$rdx', 'size_t len'), Param('$r10', 'unsigned int flags')])
syscall_table64[0x115] = Entry('sync_file_range', [Param('$rdi', 'loff_t offset loff_t nbytes'), Param('$rsi', 'unsigned int flags')])
syscall_table64[0x116] = Entry('vmsplice', [Param('$rdi', 'int fd'), Param('$rsi', 'const struct iovec *iov'), Param('$rdx', 'unsigned long nr_segs'), Param('$r10', 'unsigned int flags')])
syscall_table64[0x117] = Entry('move_pages', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'unsigned long nr_pages'), Param('$rdx', 'const void * *pages'), Param('$r10', 'const int *nodes'), Param('$r8', 'int *status'), Param('$r9', 'int flags')])
syscall_table64[0x118] = Entry('utimensat', [Param('$rdi', 'int dfd'), Param('$rsi', 'const char *filename'), Param('$rdx', 'struct timespec *utimes'), Param('$r10', 'int flags')])
syscall_table64[0x119] = Entry('epoll_pwait', [Param('$rdi', 'int epfd'), Param('$rsi', 'struct epoll_event *events'), Param('$rdx', 'int maxevents'), Param('$r10', 'int timeout'), Param('$r8', 'const sigset_t *sigmask'), Param('$r9', 'size_t sigsetsize')])
syscall_table64[0x11a] = Entry('signalfd', [Param('$rdi', 'int ufd'), Param('$rsi', 'sigset_t *user_mask'), Param('$rdx', 'size_t sizemask')])
syscall_table64[0x11b] = Entry('timerfd_create', [Param('$rdi', 'int clockid'), Param('$rsi', 'int flags')])
syscall_table64[0x11c] = Entry('eventfd', [Param('$rdi', 'unsigned int count')])
syscall_table64[0x11d] = Entry('fallocate', [Param('$rdi', 'int mode loff_t offset'), Param('$rsi', 'loff_t len')])
syscall_table64[0x11e] = Entry('timerfd_settime', [Param('$rdi', 'int ufd'), Param('$rsi', 'int flags'), Param('$rdx', 'const struct itimerspec *utmr'), Param('$r10', 'struct itimerspec *otmr')])
syscall_table64[0x11f] = Entry('timerfd_gettime', [Param('$rdi', 'int ufd'), Param('$rsi', 'struct itimerspec *otmr')])
syscall_table64[0x120] = Entry('accept4', [Param('$rdi', 'int fd'), Param('$rsi', 'struct sockaddr *upeer_sockaddr'), Param('$rdx', 'int *upeer_addrlen'), Param('$r10', 'int flags')])
syscall_table64[0x121] = Entry('signalfd4', [Param('$rdi', 'int ufd'), Param('$rsi', 'sigset_t *user_mask'), Param('$rdx', 'size_t sizemask'), Param('$r10', 'int flags')])
syscall_table64[0x122] = Entry('eventfd2', [Param('$rdi', 'unsigned int count'), Param('$rsi', 'int flags')])
syscall_table64[0x123] = Entry('epoll_create1', [Param('$rdi', 'int flags')])
syscall_table64[0x124] = Entry('dup3', [Param('$rdi', 'unsigned int oldfd'), Param('$rsi', 'unsigned int newfd'), Param('$rdx', 'int flags')])
syscall_table64[0x125] = Entry('pipe2', [Param('$rdi', 'int *fildes'), Param('$rsi', 'int flags')])
syscall_table64[0x126] = Entry('inotify_init1', [Param('$rdi', 'int flags')])
syscall_table64[0x127] = Entry('preadv', [Param('$rdi', 'unsigned long fd'), Param('$rsi', 'const struct iovec *vec'), Param('$rdx', 'unsigned long vlen'), Param('$r10', 'unsigned long pos_l'), Param('$r8', 'unsigned long pos_h')])
syscall_table64[0x128] = Entry('pwritev', [Param('$rdi', 'unsigned long fd'), Param('$rsi', 'const struct iovec *vec'), Param('$rdx', 'unsigned long vlen'), Param('$r10', 'unsigned long pos_l'), Param('$r8', 'unsigned long pos_h')])
syscall_table64[0x129] = Entry('rt_tgsigqueueinfo', [Param('$rdi', 'pid_t tgid'), Param('$rsi', 'pid_t pid'), Param('$rdx', 'int sig'), Param('$r10', 'siginfo_t *uinfo')])
syscall_table64[0x12a] = Entry('perf_event_open', [Param('$rdi', 'struct perf_event_attr *attr_uptr'), Param('$rsi', 'pid_t pid'), Param('$rdx', 'int cpu'), Param('$r10', 'int group_fd'), Param('$r8', 'unsigned long flags')])
syscall_table64[0x12b] = Entry('recvmmsg', [Param('$rdi', 'int fd'), Param('$rsi', 'struct mmsghdr *mmsg'), Param('$rdx', 'unsigned int vlen'), Param('$r10', 'unsigned int flags'), Param('$r8', 'struct timespec *timeout')])
syscall_table64[0x12c] = Entry('fanotify_init', [Param('$rdi', 'unsigned int flags'), Param('$rsi', 'unsigned int event_f_flags')])
syscall_table64[0x12d] = Entry('fanotify_mark', [Param('$rdi', 'unsigned int flags __u64 mask'), Param('$rsi', 'int dfd const char *pathname')])
syscall_table64[0x12e] = Entry('prlimit64', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'unsigned int resource'), Param('$rdx', 'const struct rlimit64 *new_rlim'), Param('$r10', 'struct rlimit64 *old_rlim')])
syscall_table64[0x12f] = Entry('name_to_handle_at', [Param('$rdi', 'int dfd'), Param('$rsi', 'const char *name'), Param('$rdx', 'struct file_handle *handle'), Param('$r10', 'int *mnt_id'), Param('$r8', 'int flag')])
syscall_table64[0x130] = Entry('open_by_handle_at', [Param('$rdi', 'int mountdirfd'), Param('$rsi', 'struct file_handle *handle'), Param('$rdx', 'int flags')])
syscall_table64[0x131] = Entry('clock_adjtime', [Param('$rdi', 'const clockid_t which_clock'), Param('$rsi', 'struct timex *utx')])
syscall_table64[0x132] = Entry('syncfs', [Param('$rdi', 'int fd')])
syscall_table64[0x133] = Entry('sendmmsg', [Param('$rdi', 'int fd'), Param('$rsi', 'struct mmsghdr *mmsg'), Param('$rdx', 'unsigned int vlen'), Param('$r10', 'unsigned int flags')])
syscall_table64[0x134] = Entry('setns', [Param('$rdi', 'int fd'), Param('$rsi', 'int nstype')])
syscall_table64[0x135] = Entry('getcpu', [Param('$rdi', 'unsigned *cpup'), Param('$rsi', 'unsigned *nodep'), Param('$rdx', 'struct getcpu_cache *unused')])
syscall_table64[0x136] = Entry('process_vm_readv', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'const struct iovec *lvec'), Param('$rdx', 'unsigned long liovcnt'), Param('$r10', 'const struct iovec *rvec'), Param('$r8', 'unsigned long riovcnt'), Param('$r9', 'unsigned long flags')])
syscall_table64[0x137] = Entry('process_vm_writev', [Param('$rdi', 'pid_t pid'), Param('$rsi', 'const struct iovec *lvec'), Param('$rdx', 'unsigned long liovcnt'), Param('$r10', 'const struct iovec *rvec'), Param('$r8', 'unsigned long riovcnt'), Param('$r9', 'unsigned long flags')])
syscall_table64[0x138] = Entry('kcmp', [Param('$rdi', 'pid_t pid1'), Param('$rsi', 'pid_t pid2'), Param('$rdx', 'int type'), Param('$r10', 'unsigned long idx1'), Param('$r8', 'unsigned long idx2')])
r2 = None
is_pannel = False
def ImportR2():
global r2
if r2 is None:
try:
import r2pipe
r2 = r2pipe.open()
except Exception:
pass
def OutStr(strin):
global is_pannel, r2
if r2 is None:
ImportR2()
if is_pannel and r2:
cmd = "?e " + str(strin)
#print(cmd)
r2.cmd(cmd)
else:
print(strin)
is_arch64 = True
def ShowCurrentArch():
global is_arch64
if is_arch64:
OutStr("arch: 64 bits:")
else:
OutStr("arch: 32 bits:")
syscall_table = syscall_table64
show_extra = False
if any("/pannel" in s for s in sys.argv):
is_pannel = True
if any("/extra" in s for s in sys.argv):
show_extra = True
if any("/32" in s for s in sys.argv):
is_arch64 = False
syscall_table = syscall_table32
if any("/printable" in s for s in sys.argv):
ShowCurrentArch()
formatted = pprint.pformat(syscall_table, indent=4)
for line in formatted.splitlines():
line = line.replace("{"," ")
line = line.replace("}"," ")
id = line.split(":")[0].strip()
id = hex(int(id))
OutStr(id + line + "\n")
if any("/sysinfoX" in s for s in sys.argv) or any("/sysinfoD" in s for s in sys.argv):
ShowCurrentArch()
for s in sys.argv:
if "/sysinfo" in s:
if s.split('o')[1][0] == 'D':
id = int(s.split('D')[1])
elif s.split('o')[1][0] == 'X':
id = int(s.split('X')[1], 16)
OutStr("syscall: " + str(id) + " - " + hex(id))
OutStr(str(syscall_table[id]) + "\n")
if any("/exit" in s for s in sys.argv):
exit()
ImportR2()
if r2 is None:
print("cant import r2pipe")
exit()
try:
if is_arch64:
raxv = r2.cmd("dr rax")
oraxv = r2.cmd("dr?orax")
else:
raxv = r2.cmd("dr eax")
oraxv = r2.cmd("dr?oeax")
syscall_index_rax = int(raxv, 16);
syscall_index_orax = int(oraxv, 16);
except:
OutStr("\n\nAn exception occurred, are you using /32 param for 32 processes? Ex: #!pipe python3 r2-syscall-printer.py /32\n\n")
if syscall_index_rax in syscall_table:
syscall_index = syscall_index_rax
else:
syscall_index = syscall_index_orax
if syscall_index in syscall_table:
syscall_entry = syscall_table[syscall_index]
syscall_name = syscall_entry.name + "() - " + hex(syscall_index) + " - " + str(syscall_index)
OutStr(syscall_name)
parameters = [s.param for s in syscall_entry.params]
registers = [s.reg for s in syscall_entry.params]
extra = ""
for reg, param in zip(registers, parameters):
reg = reg.replace("$", "")
val = int(r2.cmd("dr?" + reg), 16);
OutStr(str(reg) + " - " + param + " - " + hex(val) + " - " + str(val))
if show_extra and "char" in param and param.count("*") > 1 and val is not 0:
if is_arch64:
extra += reg + " - " + hex(val) + " :\n" + r2.cmd("pxrQ @ " + reg)
else:
extra += reg + " - " + hex(val) + " :\n" + r2.cmd("pxrW @ " + reg)
elif show_extra and "char" in param and "*" in param and val is not 0:
extra += reg + " - " + hex(val) + " : " + r2.cmd("ps @ " + reg)
if show_extra:
OutStr("-\n" + extra)
else:
OutStr("There is no system call for {:#x}".format(syscall_index))