I would like to record all memory read operations that are performed by an application on a given input file, to help infer which specific parts of an input are relevant for the specific execution that opens the input.
I'm trying to achieve this for Windows applications, whereas the applications itself can be
x64, and the input is not of a specific format (e.g. solution should not only work with
JPG, but also
XYZ). The solution is intended to work for applications without access to the source code (binaries only, no symbols).
- Input file is
100bytes long, binary format.
Can be called like
> Program.exe foo.bar, or through File > Open > foo.bar
Opens foo.bar and parses offsets
zand does something with it (e.g. convert to something else, output somewhere, do some arithmetic with it and return result, etc.). For input
foo.bar2, the offsets that are worked with might be different.
Potential problems I can think of:
If the developer uses something like
fseek (SetFilePointer?), they would go directly to the relevant offset within the input. However, in many cases it might be more likely to open the whole input/file and then go to offsets based on other specific values within that input by using something like
There are multiple methods how an input file can be opened or accessed by an application (
Speed might be an issue if there are many read operations (however, in my case I don't care too much about performance).
As per my current understanding, what I could do as a start is to:
1) Research the specific Windows APIs for file opening/handling
2) Set a breakpoint on them and retrieve the parameters
3) From here on, how can I determine or map the specific offsets within an input and the program access on it?
Is there any script or tool that already does something like this, e.g. by relying on WinDbg or DBI frameworks like DynamoRIO or PIN?
If not, I'd really appreciate if someone can point me towards specific resources or key words that would help me in better understand how to approach this problem and come up with a pratical solution. Any help would be much appreciated.