When an engineer starts analyzing a sample and opens it in a disassembler, here is what syscalls will look like:
Figure 2: Mirai clone compiled for the ARM platform using the connect syscall
In the preceding screenshot, we can see that the number 0x90011B is used in assembly instead of a more human-friendly connect string. Hence, it is required to map these numbers to strings first. The exact approach will vary depending on the tools that are used. For example, in IDA, in order to find the proper syscall mappings for ARM, the engineer needs to do the following:
- First, they need to add the corresponding type library. Go to View | Open subviews | Type libraries (Shift + F11 hotkey), then right-click | Load type library... (Ins hotkey) and choose gnulnx_arm (GNU C++ arm Linux).
- Then, go to the Enums tab, right-click | Add enum... (Ins hotkey), choose Add standard enum by enum name, and add MACRO_SYS.
- This enum will contain the list of all syscalls. It might be easier...