3

I would like to record all memory read operations that are performed by an application on a given input file, to help infer which specific parts of an input are relevant for the specific execution that opens the input.

I'm trying to achieve this for Windows applications, whereas the applications itself can be x86 or x64, and the input is not of a specific format (e.g. solution should not only work with JPG, but also PNG or XYZ). The solution is intended to work for applications without access to the source code (binaries only, no symbols).

An example

Input foo.bar:

  • Input file is 100 bytes long, binary format.

Program n:

  • Can be called like > Program.exe foo.bar, or through File > Open > foo.bar

  • Opens foo.bar and parses offsets x, y, and z and does something with it (e.g. convert to something else, output somewhere, do some arithmetic with it and return result, etc.). For input foo.bar2, the offsets that are worked with might be different.

Potential problems I can think of:

  • If the developer uses something like fseek (SetFilePointer?), they would go directly to the relevant offset within the input. However, in many cases it might be more likely to open the whole input/file and then go to offsets based on other specific values within that input by using something like offset_n+34.

  • There are multiple methods how an input file can be opened or accessed by an application (OpenFile, CreateFileA/W, MapViewOfFile, OpenFileMappingA, etc.)

  • Speed might be an issue if there are many read operations (however, in my case I don't care too much about performance).

As per my current understanding, what I could do as a start is to:

1) Research the specific Windows APIs for file opening/handling

2) Set a breakpoint on them and retrieve the parameters

3) From here on, how can I determine or map the specific offsets within an input and the program access on it?

Is there any script or tool that already does something like this, e.g. by relying on WinDbg or DBI frameworks like DynamoRIO or PIN?

If not, I'd really appreciate if someone can point me towards specific resources or key words that would help me in better understand how to approach this problem and come up with a pratical solution. Any help would be much appreciated.

  • I think a general concept you are talking about called taint analysis. – macro_controller Mar 1 at 10:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.