Ophir Harpaz ophirharpaz

## rename_functions_by_syscalls.py
SYSCALL_OPCODE = '\xCD\x80'
REGULAR_COMMENT = 0  # as opposed to a repeatable one


def get_syscalls_addresses():
    return (h for h in Heads() if SYSCALL_OPCODE == GetManyBytes(h, ItemSize(h)))


def get_syscall_name_from_addr(addr):
    # Fetch the syscall name from IDA's automatic comment

## get_call_flows_from_exports.py
"""
The script generates and prints a graph of all function-call flows that start in exported functions and end
in the function being pointed at in IDA.
This functionality is useful when you need to trigger a function in a DLL and wish to know which exported function
leads to it.
"""

import idaapi
import idautils
import idc
	SYSCALL_OPCODE = '\xCD\x80'
	REGULAR_COMMENT = 0 # as opposed to a repeatable one


	def get_syscalls_addresses():
	return (h for h in Heads() if SYSCALL_OPCODE == GetManyBytes(h, ItemSize(h)))


	def get_syscall_name_from_addr(addr):
	# Fetch the syscall name from IDA's automatic comment
	"""
	The script generates and prints a graph of all function-call flows that start in exported functions and end
	in the function being pointed at in IDA.
	This functionality is useful when you need to trigger a function in a DLL and wish to know which exported function
	leads to it.
	"""

	import idaapi
	import idautils
	import idc