handle pre-existing hooks in ntoskrnl syscalls during number determination

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on May 07, 2013 13:39:40_

Today DrSyscall relies on decoding the ntdll wrappers to find the numbers
for ntoskrnl syscalls. This fails if there's a pre-existing hook there
(DR's hooks are inserted after drsys_init()).

We've seen this w/ some AV software:

~~Dr.M~~ ASSERT FAILURE (thread 12280):
......\drmemory\common\utils.c:846: ok_to_fail (error finding required
syscall #)

0:000> U ntdll!NtTerminateProcess
ntdll!NtTerminateProcess:
778cfc90 e9770f8488 jmp 00110c0c
778cfc95 33c9 xor ecx,ecx

Solutions:

1) Earliest injection: then drmem initializes before any weirdness from
snxhk -- but that's not finished yet, and we'd like to support late
injection + attach for other purposes

2) Have a table of #s like we use for win32k.sys

3) Try to figure out # via decoding by following hook: not really
practical in an automated way at startup b/c hooks are needless to say
non-standard in how they resume

_Original issue: http://code.google.com/p/drmemory/issues/detail?id=1220_