Incorrect syscall numbers [using the latest build]
Created by: dvfdr43
I'm using following code to get syscall number:
auto entry = (PBYTE)(dr_get_proc_address(ntdll_handle, function_name));
DR_ASSERT(entry != NULL);
auto syscall_number = drmgr_decode_sysnum_from_wrapper(entry);
After that, I'm printing syscall numbers and seems like some of them are incorrect, for example NtWriteFile and NtClose: