Reverse Engineering The Database Brandon Tucker – DBA, OppenheimerFunds, Inc.

Who Am I? Brandon Tucker BS Computer Science, Neumont University MCITP: DB Developer VP Events, Denver SQL Server User Group DBA, DB Dev, Consultant Financial, health insurance, transportation, education industries SQL 2005 – 2012 Presented at events in multiple states Has a wicked case of wanderlust… :) http://www.linkedin.com/in/btuck

Find The Man/Woman Of Your Dreams! After This Session… You’ll be able to: Use a few tools to dabble in reverse engineering a database Run Faster! Hack Any Database! Find The Man/Woman Of Your Dreams! Make $1,000,000!

Third-Party Applications Agenda Third-Party Applications Why Reverse Engineer? Tools Available Methods Recap, Q / A

Third-Party Applications Introduction “We have this new product, can you create the database for us?” (DBA) “We have this new product and it needs a database server!” (Dev)

Third-Party Applications Types Phone systems Ticketing systems Monitoring software SQL Sentry, Idera, Quest, Confio, etc SQL Server Management Studio OK, maybe not, but makes a good demo! master & msdb are storing data behind the scenes!

Third-Party Applications Agenda Third-Party Applications Why Reverse Engineer? Tools Available Methods Recap, Q / A

Why Reverse Engineer? Reasons Someone thought the information was important enough to store somewhere other than text files Someone thought there was a lot of information Limited tools provided by the vendor Limited views of the data

Why Reverse Engineer? Reasons And… You’re probably smarter than the vendor anyway… You know more about the value of the information… You care more… You could make your life easier/better/<insert adjective here>!

Third-Party Applications Agenda Third-Party Applications Why Reverse Engineer? Tools Available Methods Recap, Q / A

Tools Available Introduction Need to capture queries coming through the system Need to look at how data changes Need to be able to piece things together

Object Explorer SQL Server Profiler Data Compares Database Audits Tools Available List Object Explorer SQL Server Profiler Data Compares Database Audits Change Data Capture Plenty of others

Tools Available Object Explorer Found in Management Studio Easiest way to browse objects in a database Gives a good 50,000 foot view Are the tables intelligibly named? Difficult with a large number of tables

Tools Available SQL Profiler Traces Stored Procedures-RPC:Starting Stored Procedures-SP:StmtStarting TSQL-SQL:StmtStarting Provides the most information with little prior knowledge May take a few tries to narrow down your search DEMO: SQL Server Profiler

Tools Available Others Data compares, Database Audits, Change Data Capture These all look at the data itself Good if you have a small number of tables and low throughput Likely not the case

Third-Party Applications Agenda Third-Party Applications Why Reverse Engineer? Tools Available Methods Recap, Q / A

We need to find where the data goes (tables) Methods Plan of Attack We need to find where the data goes (tables) We need to find how the data gets there DML statements? Stored procs? Once we know these, we can start putting the pieces together

Methods Where Does The Data Go? If possible, use your application to put in some data Use SQL Server Profiler on all SQL hitting that server/database (if known) Pick text that you might be able to filter on Create a customer record with a “zzzz” name Create a new ticket with “zzzz” in the description Be careful about developing in production!

Methods How Did The Data Get There? Try to identify the SQL that put the data in Was it an INSERT statement? Was it a stored procedure? DEMO: SQL Agent job These are relational databases; the data is likely in multiple places! Don’t be content with just one table

Methods Putting The Pieces Together This will feel very much like a puzzle Use all of the tools available to you! Object Explorer can help with foreign keys (think Database Diagrams) Data deltas/audits can show you the complete data picture More specific traces (host, user) can reduce the noise and get you to the good stuff

Methods Putting The Pieces Together Try writing queries to see if things make sense “Shaping” queries DEMO: msdb query Be creative in figuring out short names, acronyms, etc. Make the data work for your needs Remember: a lot of databases are poorly designed/built!

Third-Party Applications Agenda Third-Party Applications Why Reverse Engineer? Tools Available Methods Recap, Q / A

Musings, Gotchas, Closing Thoughts This is not a perfect science Companies trying to obfuscate their database can make things very difficult Encrypted stored procedures can spell D-O-O-M for you As with all monitoring, be careful of your impact to the environment

Outro Q / A Thank You!

Community/SWAG Sponsors Thank You Sponsors! Gold Sponsor Silver Sponsors Marquee Sponsors Bronze Sponsors Qortex Community/SWAG Sponsors