6

I am reversing a closed-source legacy application that uses Microsoft SQL Server (2005) and I would like to find out precisely what queries are being executed in the background.

I understand that it may be possible to use Wireshark to view the network traffic, but it feels quite clumsy so I am looking for something more specialized for this purpose.

Is there a tool that is similar to Firefox's Tamper Data, but for MSSQL to view, and possibly edit queries?

Features that I am looking for:

  • Able to view queries precisely as executed by the application (including blobs etc.)

Features that would be very useful:

  • Able to intercept query execution and allow edits to the value
| improve this question | |
10

Most databases are very friendly to tracing and profiling while the database is running. You need to do very little actual reverse engineering. There's a program called SQL Server Profiler which I believe can dump every single query executed against the database. If you don't have access to the server it becomes a bit more complicated.

If your application is using ADO you might be able to use Statement tracer for ADO.

A more complex way of doing what you want depends on what sort of database layer your application is using. If the layer is COM based (OLE DB is), then you have two options, either drill into the COM interface or create a COM proxy. I would probably simply hook the objects which derive from the various OLE DB ICommandXXX interfaces.

| improve this answer | |
  • 1
    +1 (A) SQL Profiler is the way to go. Do note that MS SQL Server Profiler is not includes with the Express editions in which case you may need a 3rd party tool such as this one – Remko Mar 23 '13 at 10:08
  • If you like to hook into SQL Server yourself, what exported function would you intercept to see the queries as strings? As jg0 says you can sniff the queries as part of the whole protocol. The SQLDK.dll, SQLLANG.dll, and SQLMIN.DLL contains a lot of exported functions but it is no clear if hooking onto a specific one you can find the original query as an string. It would be interesting to have this monitoring alternative. – sw. Mar 25 '13 at 18:50
  • I don't know the details of what functions SQL server actually exports or their internals. I tend to be too lazy when it comes to issues such as this and follow the path of least resistance. – Peter Andersson Mar 26 '13 at 18:54
3

There is nothing wrong with using the TDS protocol decoder that comes with WireShark, assuming the connection is established via something that can be sniffed by WireShark. This is a specialized protocol decoder for TDS so I am not sure what you mean by:

I understand that it may be possible to use Wireshark to view the network traffic, but it feels quite clumsy so I am looking for something more specialized for this purpose.

If you want to get your hands dirty you can write a proxy based on FreeTDS. The perhaps biggest problem seems that either this project is now mature or abandoned. The tdspool program is probably your best point to start if you wanted to write a proxy. But it's possible you could coerce jTDS into doing what you want (from a casual reading of the source code it doesn't seem to be as good a starting point as the tdspool program).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.