1

This happens a lot where when I am reversing a program in a disassembler or debugger, I run into something like this:

push    eax             ; lParam
push    1               ; wParam
push    80h             ; Msg
push    ecx             ; hWnd
call    esi ; SendMessageA

In order to effectively reverse this, I need to know what 80h is. The problem is that when compiled (preprocessed), all of the Windows constant macros obviously get turned into numbers so I no longer have the semantic meanings. I also cannot go and search for "SendMessage 0x80" because there's no real context there either.

The question is, what are some tips in figuring out a Microsoft Windows constant macro name when given only a function and a value like this? I was able to go to SendMessage on MSDN and then from there, look at the Msg parameter which lead me to the System-Defined Messages page. However, like many other MSDN pages, this one only defines the macros by description, rather than provides a table of which value each one corresponds to. This has actually been a regular issue that I've ran into in reversing Windows applications. Another solution I've discovered is to try and locate the .h file for the corresponding macros online and then search for the value there. But this situation is less than ideal because I have no idea if the information is accurate up-to-date, but many times I also do not even know which header file would contain the definition.

  • There is no another way then analyze and extract those values from the H files. It's either your do it or wait for someone else. For most MS API there is a H file in the SDK, so that's the place to start. – PhoeniX May 15 '17 at 13:19
  • This site magnumdb.com compiles values from all Windows header files (280000+ values/constants...). But 0x80 is very common. In this case, since you know it's a windows message, you can use a specific query: magnumdb.com/search?q=title%3AWM%2A+AND+value%3A128 it will successfully return WM_SETICON as the best match – Simon Mourier May 17 '17 at 19:39
2

These constants are usually defined in the header file corresponds to the API function in use.

You can discover the name of the header file by going into MSDN's SendMessageA page, and looking at the Header row of the Requirements table at the bottom.

In this case, the relevant header is Winuser.h, which you could find in the SDK corresponds to the development platform of the binary you're reversing.

After looking at Winuser.h and searching for the constant, you'll find the next definition:

#define WM_SETICON                      0x0080

This process is a bit tedious, but that's the most accurate way to interpret WINAPI constants.


Another thing you might do, if you use IDA for reversing, is to mark the constant and press M(for "Use standard symbolic constant").

There, you could see all the possible constants that IDA resolved that match the value you marked, and filter that list by the context of the value.
In this case, since you know it corresponds to a Windows Message, the constant name starting with WM should be the one you're looking for. (this name prefix information could also be located in the link you provided)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.