At least for me, reading is not enough. It gives some good context, but actually using that knowledge to accomplish tasks helps to solidify that knowledge. Viewing my knowledge as a network of interconnected nodes also helps me reason about it. Reading a key/value dictionary from start to finish doesn't leave enough interconnected nodes for that information to persist long. Knowledge seems to solidify when it is connected and linked to other bits of knowledge but islands of knowledge seem hard to retain. E.g. Those seemingly random windows api calls are easier to remember when you know of their Linux equivalent, in what cases you call those methods, what other methods call that method, what methods that method itself calls, what happened last time you called those methods, etc. I doubt they remembered them because they read the source code once and have a photographic memory.
Or, having been there, maybe they remembered them because they were interesting/weird tidbits that caused them to have to debug something for hours. Or perhaps they ran into those weird things last week. (I will never forget, for example, that certain glibc functions such as system() use movaps to copy data from the stack - because it’ll crash the program when you call them from an unaligned stack ROP...)
