2

The Hex-rays decompiler demo video shows that you can select what to replace Windows magic variables (1,2,3, etc) with: http://www.ccso.com/files/hexraysdemo.swf

But how do you know what the numbers should be replaced with in the first place?

4

Those magic numbers are Enums since these are window Api you can either look them up in include files or look up the function in MSDN documentation online

take the first example DllEntryPoint which typically is a wrong name by Ida (it should be DllMain)

google DllMain site:msdn.microsoft.com

first page first hit

http://msdn.microsoft.com/en-us/library/windows/desktop/ms682583%28v=vs.85%29.aspx

You can see it is documented as

BOOL WINAPI DllMain(
  _In_  HINSTANCE hinstDLL,
  _In_  DWORD fdwReason,
  _In_  LPVOID lpvReserved
);

the second parameter command is documented to contain

fdwReason [in]

    The reason code that indicates why the DLL entry-point function is being called. This parameter can be one of the following values.
    Value   Meaning

    DLL_PROCESS_ATTACH
    1
    DLL_PROCESS_DETACH
    0
    DLL_THREAD_ATTACH
    2 
    DLL_THREAD_DETACH
    3

there you have the magic numbers in this specific case the document also contains the 1,2,3 but if the document didn't contain the values

you have to look into include files in sdk or wdk as the case may be

this specific magic number is defined in winnt.h in platform sdk

C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>pss DLL_THREAD_DETACH

C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>python c:\python27\scripts\
pss -i DLL_THREAD_DETACH
.\WinNT.h
13666:#define DLL_THREAD_DETACH    3


C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>

each function will have parameters and each parameter can contain certain values and if the parameter is not opaque then it will have documentation of the parameters in MSDN help

you need to read the documentation of the function its parameters and decide what those magic numbers are to be replaced with up

second example OpenMutex()

msdn shows that the parameter documentation as

Parameters

dwDesiredAccess [in]

    The access to the mutex object. Only the SYNCHRONIZE access right is required to use a mutex; to change the mutex's security, specify MUTEX_ALL_ACCESS. The function fails if the security descriptor of the specified object does not permit the requested access for the calling process. For a list of access rights, see Synchronization Object Security and Access Rights.  

follow the list of access right link to see what is the value of MUTEX_ALL_ACCESS

or check include file for the trail

C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>python c:\python27\scripts\
pss -i mutex_all_access
.\WinBase.h
560:#define MUTEX_ALL_ACCESS MUTANT_ALL_ACCESS


C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>pss mutant_all_access

C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>python c:\python27\scripts\
pss -i mutant_all_access
.\WinBase.h
560:#define MUTEX_ALL_ACCESS MUTANT_ALL_ACCESS

.\WinNT.h
8557:#define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\


C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>grep -i mutant_all_access -
A 3 -B 3 WinNT.h

#define MUTANT_QUERY_STATE      0x0001

#define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\
                          MUTANT_QUERY_STATE)

#define SEMAPHORE_MODIFY_STATE      0x0002

C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>
2
  • How does that prevent you from making mistakes, like all the time? – user8005 Aug 11 '13 at 5:07
  • absolutely doesn't prevent making mistakes in fact those who can make such mistakes will simply drag you down to their level and beat you with their vastly superior experience – blabb Aug 11 '13 at 5:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.