I'm trying to find all active forms that have a particular field on them.  Below is my query for finding a field in groups and it works great.  But parsing the blob field for plugin type 28 has not been so successful.  There appears to be another block of binary within it that I think contains the field information.  If anyone knows how to accomplish this I would greatly appreciate the help.

DECLARE @strFIELD VARCHAR(max)

SET @strFIELD = 'TYPE'

with Groups

AS (SELECT PLUGIN.NAME AS GroupName, PLUGIN.FAMILY, plugin.pluginid, DATA as DATA1,

 CONVERT(VARCHAR(MAX), CONVERT(VARBINARY(8000), DATA), 1) DATA

FROM PLUGIN with (nolock)

LEFT OUTER JOIN SECCODE  with (nolock)

ON PLUGIN.USERID = SECCODE.SECCODEID

LEFT OUTER JOIN USERINFO with (nolock)

ON PLUGIN.USERID = USERINFO.USERID

WHERE PLUGIN.TYPE = 8

and  userinfo.username is not null)

,Fields

AS (select

GroupName,Family,Pluginid,

CASE WHEN DATA LIKE '%SQL.STRING%'

                         THEN

SUBSTRING(DATA,CharIndex('SQL.STRINGS',DATA),CharIndex('KeepAlive',DATA)-

CHARINDEX('SQL.STRINGS',DATA))

ELSE NULL END AS SQLString

FROM Groups)

Select

GroupName,Family,Pluginid,@STRFIELD KeyField

FROM Fields

where SQLString like '%' + @STRFIELD + '%'

Order by GroupName,Family Asc  ;

You might try Electrician, though I have to admit it's badly out-of-date at this point. You are correct in that there are hex-encoded blocks within the streamed binaries; Electrician tries to decode them, but doesn't always succeed. Unfortunately, decoding them completely requires access to the source code of the Delphi components being streamed, and that code is of course proprietary. Still, it's better than trying to do it with just a SQL query.

Good luck!