5.2.1 Checking The Presence Of CreateFile API

If you recall, upon disassembly, IDA tries to identify whether the disassembled function is a library function or an import function by using pattern matching algorithms. It also derives the list of names from the symbol table; such derived names can be accessed by using the Names window (via View | Open subview | Names or Shift + F4). The Names window contains the list of imported, exported, and library functions, and named data locations. The following screenshot displays the CreateFileA API functions in the Names window:

You can also programmatically access the named items. The following IDAPython ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.