This is my first post here (&hopefully not the last one!)
First of all, I gotta say I am no RE expert so I might sound a little confused.
So I have got a Delphi program consisting of two files (as far as you are concerned):
program.bin is a database the extraction of which is my final objective. By extraction I mean to have an original db file or something that is tangible and does not lack any information.
The program is a GUI application that does nothing except loading the database and showing it in two columns (at least this is what I see).
- Language: Borland Delphi 6-7 (thanks to PEiD)
- IDE used: RAD Studio (most probably)
What I did
- I tried DeDe, but for some reason program.exe does not load fully (which I guess makes it harder to decompile).
- I tried (almost) all of the BDE type of database viewers (paradox, dBase etc.). Why? because I found these strings while scrolling the assembly code in Olly. None of them were successful except one. Some of them crashed during the opening, others said it had incorrect headers. The one that worked was password recovery program that did not reject the file and, moreover, told me the password! :D.
- I tried lots of filetype detector programs. All of them failed except for "File Analyzer" which told me for 99% accuracy[sic] that it was VisiCalc file, which c'mon can't be true xD.
- I tried Process Monitor and saw that program.bin is read by chunks of 64 bytes. (not sure if this is useful information).
- I also tried some famous analysis tools (idr, Olly) tried observing codes for hours, but as I am not knowledgeable I was not able use them.
- Apart from that I spotted "paradox", "dBase" strings in the assembly, I also saw that it has some relation to cryptbase.dll, which led me thinking it might be encrypted, but surprisingly IDA does not list cryptbase.dll in the import list of libraries.
- While inspecting the results of IDR I saw that program.exe has actually a dblogin form. If this really exists then it is invisible I guess.
So my question is what can I do? how can I place myself between the components so that I can see what it does?
P.S. I can put a link to the executable but I do not want to make it specific. I intend to acquire general techniques here.
NOTE: This is purely for educational purposes only, as I already have this database. What I did was basically dump the memory where the program placed its database. (BTW, is there any small tool for dumping specific range of memory? I used Win7's original dumper in the Task Manager)