agentsclimarketplace
Sign in

Resolving dynamic api hashing

Skill meltedinhex/analyst-ai-pack/skills/resolving-dynamic-api-hashing

Resolves dynamically hashed Windows API names by brute-forcing observed hash constants against a wordlist of API/DLL names using common malware hashing algorithms (ROR13, djb2, FNV, CRC32). Activates for requests to resolve API hashes, identify hashed imports, or reverse an API hashing routine.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill resolving-dynamic-api-hashing

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.6 KB, 411 tokens by cl100k_base, as published. Nobody here has run it

Resolving Dynamic API Hashing

When to Use

  • A sample resolves APIs by hash (no plaintext import names) and you have the hash constants from disassembly.
  • You need to map each hash back to an API/DLL name to understand functionality.

Do not use this to execute the resolver — it computes hashes over a name wordlist statically and matches them to your observed constants.

Prerequisites

  • The hash constants observed in the binary and (optionally) a names wordlist.

Workflow

Step 1: Identify the algorithm

python scripts/analyst.py id 0x6A4ABC5B

Computes the constant under each supported algorithm against a built-in seed list to suggest which algorithm/seed reproduces known API hashes.

Step 2: Resolve hashes against a wordlist

python scripts/analyst.py resolve hashes.txt --algo ror13 --wordlist names.txt

Brute-forces the provided hashes against the wordlist using the chosen algorithm and reports matches.

Step 3: Annotate the disassembly

Label resolved call sites with their API names to recover behavior.

Step 4: Document the routine

Record the algorithm, seed/initial value, and any key so the routine is reusable.

Validation

  • The chosen algorithm reproduces at least one known API hash (sanity anchor).
  • Resolved names are real exported symbols of plausible DLLs.
  • Unresolved hashes are reported, not silently dropped.

Pitfalls

  • Wrong endianness/rotation direction producing no matches — try variants.
  • Algorithms seeded with a per-sample key; without the key, matches fail.
  • Case sensitivity: some routines hash uppercased names, others as-is.

References

What ships with it: 3 files

4.9 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.