With the dynamic WinAPIs resolution, only one function with different arguments is being used to get access to all the WinAPIs. It dynamically searches for the requested API (and often the corresponding DLL), usually using some sort of checksum of the name that's provided as an argument. There are two common approaches to making this readable:
- Using enums:
- Find the matches between all checksums, APIs, and DLLs used.
- Store the associations as enum values.
- Find all the places where the resolving function is being used, take its checksum argument, and convert it into the corresponding enum name.
- Using comments:
- Find the matchings between all checksums, APIs, and DLLs used.
- Store associations in memory.
- Find all the places where the resolving function is being used, take its checksum argument, and place a comment with the corresponding API name next to it.
IDA scripting is really what makes a difference and turns novice analysts into professionals who...
