这些幻数是枚举，因为它们是窗口 Api，您可以在其中查找它们include files或在 MSDN 在线文档中查找函数

以第一个示例 DllEntryPoint 为例，它通常是 Ida 的错误名称（应该是 DllMain）

google DllMain site:msdn.microsoft.com

第一页第一次命中

http://msdn.microsoft.com/en-us/library/windows/desktop/ms682583%28v=vs.85%29.aspx

你可以看到它被记录为

BOOL WINAPI DllMain(
  _In_  HINSTANCE hinstDLL,
  _In_  DWORD fdwReason,
  _In_  LPVOID lpvReserved
);

第二个参数命令被记录为包含

fdwReason [in]

    The reason code that indicates why the DLL entry-point function is being called. This parameter can be one of the following values.
    Value   Meaning

    DLL_PROCESS_ATTACH
    1
    DLL_PROCESS_DETACH
    0
    DLL_THREAD_ATTACH
    2 
    DLL_THREAD_DETACH
    3

在这种特定情况下，您有幻数，文档还包含 1,2,3 但如果文档不包含值

您必须根据情况查看 sdk 或 wdk 中的包含文件

这个特定的幻数在平台 sdk 中的 winnt.h 中定义

C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>pss DLL_THREAD_DETACH

C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>python c:\python27\scripts\
pss -i DLL_THREAD_DETACH
.\WinNT.h
13666:#define DLL_THREAD_DETACH    3


C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>

每个函数都有参数，每个参数可以包含某些值，如果参数不是不透明的，那么它将在 MSDN 帮助中提供参数文档

您需要阅读函数及其参数的文档，并决定将哪些幻数替换为 up

第二个例子 OpenMutex()

msdn 显示参数文档为

参数

dwDesiredAccess [in]

    The access to the mutex object. Only the SYNCHRONIZE access right is required to use a mutex; to change the mutex's security, specify MUTEX_ALL_ACCESS. The function fails if the security descriptor of the specified object does not permit the requested access for the calling process. For a list of access rights, see Synchronization Object Security and Access Rights.  

按照访问权限链接列表查看 MUTEX_ALL_ACCESS 的值是多少

或检查路径的包含文件

C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>python c:\python27\scripts\
pss -i mutex_all_access
.\WinBase.h
560:#define MUTEX_ALL_ACCESS MUTANT_ALL_ACCESS


C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>pss mutant_all_access

C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>python c:\python27\scripts\
pss -i mutant_all_access
.\WinBase.h
560:#define MUTEX_ALL_ACCESS MUTANT_ALL_ACCESS

.\WinNT.h
8557:#define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\


C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>grep -i mutant_all_access -
A 3 -B 3 WinNT.h

#define MUTANT_QUERY_STATE      0x0001

#define MUTANT_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SYNCHRONIZE|\
                          MUTANT_QUERY_STATE)

#define SEMAPHORE_MODIFY_STATE      0x0002

C:\Program Files\Microsoft SDKs\Windows\v7.1\Include>