Say I have a collection of N executables, where N is large enough to make repetitive manual analysis tedious. I want to process all of these files and extract information about certain function calls, for instance from a malware analysis point of view, knowing what constant arguments were used in calls to
OutputDebugString would be of interest, and I guess for vulnerability research there may be applications, e.g. format strings.
A dynamic approach would be easiest, but has issues with code coverage and overheads when dealing with malware. I'd prefer a static approach and would be interested if anyone had any experiences to share. I was thinking along the lines of scripting IDA/HexRays to run over each binary, attempt to produce a C file and grep over the output, but this may be rather inefficient.