This is amazing, I was simply trying to figure out what the SharePoint Designer (Site->Contributor Settings) would do to permissions in the database. So, I built this entire application to do it, but then realized after I got it built that SPDesigner simply creates a file in the _contributor_settings directory in the content database and doesn't tough anything else. DOH!
This tool will find the effective permission for an object in a site. It uses a combination of object model (to get the siteid) and direct calls to the content database (rather than slow object model). This tool must be run by an administrator on a SP box in the farm. I went ahead and added in my "Find empty permission objects" code too.
Oh, and by the way, there is a column called PermMaskDeny in the Roles table. Even though SharePoint doesn't have a front end UI or object model deny mechanism...it seems they are thinking ahead to be able to implement explicit "deny" in SharePoint! Maybe in 2010? I did try setting it to something (all 1s), but it didn't do anything :( Oh well...
Enjoy!
Chris