A brilliant blog post by Ero Carrera: IDAPython in action: http://blog.dkbza.org/2008/03/digging-up-system-call-ordinals.html Just note how concise and powerful is the script!