1

I'm trying to reverse engineer an application that uses SQL server but somehow hides the database files inside its own proprietary file format. What I'm aiming to do is to write my own app that can extract the data from the application files so I can work on it using my own preferred tools.

I can use WinDbg to intercept the SQL but I can't see how the application connects its datafile with the SQL server. Can anyone suggest where I might look?

Cheers!

1

Run Sysinternals Process Monitor and look for operation on that file, by any process. Something other than sqlserver.exe might be reading it. Once you see whats reading the file, look at the stacktrace leading to the file io calls in process monitor. Attach to that process that is reading the files with WinDbg and set the appropriate breakpoints to continue reverse engineering.

| improve this answer | |
1

In the unlikely event that the file in question is just an mdf with a weird name, you can look at it with OrcaMDF by Mark S. Rasmussen.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.