8

I am working on automating some functionality within a closed-source third party application; I want to automate the creation of "Project Files" (in its simplest form, just a collection of video files in a specific order). The video files which this application works with each have an associated metadata file, and I have already managed to understand and recreate 99% of its format. Both these "project files" and the metadata files are more-or-less plain XML (with some strange tag names I have yet to decipher).

Basically, I want to know what methods I can use to determine the format of these project files so that I can write my own and reference the video files I have chosen in the prior part of my script.

There are many DLL files in the applications directory, and I was thinking that maybe monitoring their use during a save operation (of a project file in the application) could point me in the right direction? If so, how could I go about this? I have also began learning DLL injection, and was wondering if this could be of use?

Gilles 'SO- stop being evil'
  • 1,358
  • 13
  • 23
araisbec
  • 183
  • 4

1 Answers1

2

Ok, this can be tackled in a great number of ways. As you recently learned DLL injection a fun exercise is to use this knowledge to overwrite a function :)

A good start is the Inline Hooking in Windows Presentation by High-Tech Bridge and this codeproject page. What you do is overwrite the function. What you'll have to to in order to redirect the WriteFileA to your own write function. This allows you to trace-back by walking the return values to determine the flow of the data. You can also examine the way data is written (once or by chunks).

You can also Trace the application, check the addresses of data that is collected, see if it gets parsed though some kind of encryption or compression algorithm.

Hope I am some form of help. :)

Stolas
  • 2,331
  • 14
  • 34
  • Good idea! I'll give this a shot.

    Another thing I was considering was using Dependency Walker or IDA Pro (or both) to see what DLL modules are being called (in the creation of the metadata, as there are a number of DLLs which seem like they were included for this purpose). I was then going to write my own DLLs to take their place and "Man-In-The-Middle" the transfer of data...

    Do you think this is a reasonable approach (in conjunction with your method)? I'm giving you best (and only!) answer :)

     – araisbec Sep 23 '13 at 19:22
  • Well, just try what you think works the quickest. If something doesn't yield results, try something else. IDA Pro is a good investment if you are really into reverse engineering. But if it is just hobby/side-projects I'd leave it alone (maybe IDA Free) due to the costs of the product. – Stolas Sep 24 '13 at 06:28