What are ways to find Windows constant macro definitions?

Question

This happens a lot where when I am reversing a program in a disassembler or debugger, I run into something like this:

push    eax             ; lParam
push    1               ; wParam
push    80h             ; Msg
push    ecx             ; hWnd
call    esi ; SendMessageA

In order to effectively reverse this, I need to know what 80h is. The problem is that when compiled (preprocessed), all of the Windows constant macros obviously get turned into numbers so I no longer have the semantic meanings. I also cannot go and search for "SendMessage 0x80" because there's no real context there either.

The question is, what are some tips in figuring out a Microsoft Windows constant macro name when given only a function and a value like this? I was able to go to SendMessage on MSDN and then from there, look at the Msg parameter which lead me to the System-Defined Messages page. However, like many other MSDN pages, this one only defines the macros by description, rather than provides a table of which value each one corresponds to. This has actually been a regular issue that I've ran into in reversing Windows applications. Another solution I've discovered is to try and locate the .h file for the corresponding macros online and then search for the value there. But this situation is less than ideal because I have no idea if the information is accurate up-to-date, but many times I also do not even know which header file would contain the definition.

Answer 1

These constants are usually defined in the header file corresponds to the API function in use.

You can discover the name of the header file by going into MSDN's SendMessageA page, and looking at the Header row of the Requirements table at the bottom.

In this case, the relevant header is Winuser.h, which you could find in the SDK corresponds to the development platform of the binary you're reversing.

After looking at Winuser.h and searching for the constant, you'll find the next definition:

#define WM_SETICON                      0x0080

This process is a bit tedious, but that's the most accurate way to interpret WINAPI constants.

Another thing you might do, if you use IDA for reversing, is to mark the constant and press M(for "Use standard symbolic constant").

There, you could see all the possible constants that IDA resolved that match the value you marked, and filter that list by the context of the value.
In this case, since you know it corresponds to a Windows Message, the constant name starting with WM should be the one you're looking for. (this name prefix information could also be located in the link you provided)