i need to retrace database changes by an specific application. The database is really big(~8GB) and contains over 300 tables, and some of the tables have > 100 columns. Another Problem is, that the database design isnt beautiful, as example most tables arent converted into the third normal form and columnnames are not meaningful. I only have a bit reverse experience with patching, debugging, and decompiling win32 PE Files.

Luckily i have a lot experience in manual malware analytics and understand x86_64(Linux) ASM and masm. Hopefully this knowledge will help me in this task.

so, my real question is, what are common approaches to understanding database changes and understanding what the different data mean?

  • 1
    Can you give us some more information? What type of database is this? What type of changes are you trying to understand? You mean, like retrieving the history of previously-executed SQL commands that might be stored by the database? Or do you mean retrieving the previous transactions based on the database contents alone? – dingo_kinznerhook Mar 22 '19 at 14:25
  • it is a mySQL Database. The main goal is to insert valid data in the database. so if i do some action i wanna know what changes in the database are written. – frTsf3f Apr 8 '19 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.