j00ru/windows-syscalls resource

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

2631 stars · 370 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A collection of Windows system call tables extracted from ntoskrnl.exe and win32k.sys across nearly every Windows release from NT 3.x through Windows 11, in both 32-bit and 64-bit builds. Data is provided in CSV and JSON for programmatic use and as HTML tables for manual browsing.

Use cases

• look up syscall numbers for a specific Windows version
• build Windows syscall fuzzing harnesses
• write version-independent direct syscalls in security tools
• research differences in NT kernel API surface across Windows releases
• map win32k syscall numbers for GUI subsystem research
• find which service pack introduced a given syscall

When to choose

• you need authoritative syscall numbers across many Windows versions and architectures
• you are doing kernel research, exploit development, or syscall fuzzing on Windows
• you want machine-readable (CSV/JSON) syscall data

When to avoid

• you need syscall tables for non-Windows operating systems
• you want a tool or library rather than static reference data
• you need documented, officially supported Win32 APIs instead of internal syscalls

Facets

dataset · maturity active

security reverse-engineering developer-tools operating-systems security reverse-engineering developer-tools windows cross-platform windows-syscalls syscall-tables ntoskrnl win32k fuzzing-reference csv

Member repositories

For agents

markdown · JSON · MCP: product_card(name="j00ru/windows-syscalls")