How to investigate function calls across a batch of targets?

Question

Say I have a collection of N executables, where N is large enough to make repetitive manual analysis tedious. I want to process all of these files and extract information about certain function calls, for instance from a malware analysis point of view, knowing what constant arguments were used in calls to OutputDebugString would be of interest, and I guess for vulnerability research there may be applications, e.g. format strings.

A dynamic approach would be easiest, but has issues with code coverage and overheads when dealing with malware. I'd prefer a static approach and would be interested if anyone had any experiences to share. I was thinking along the lines of scripting IDA/HexRays to run over each binary, attempt to produce a C file and grep over the output, but this may be rather inefficient.

Answer 1

I wish I had an easy way to help you. When I did something similar previously, I used distorm and pefile. Basically, the approach I took in my code (and it, admittedly, wasn't a great one) was to:

1. Walk the IAT of the executable to locate the function(s) of interest.
2. Perform a recursive-descent disassembly of the executable looking for calls to that function.
3. Use the recently disassembly instructions to check what the arguments were.

In retrospect, learning the IDA scripting would have saved me a lot of time and effort but I was hard-headed. If you're going to go down the same route, I'd suggest scripting IDA. Although, I'm not sure you need to use Hex-Rays to convert it back to C code first.