3

I want to MakeArray() to stack variables which can be done with IDA like so:

MakeArray to stack variables

MakeArray() Create an array.

ea - linear address

nitems - size of array in items

This function will create an array of the items with the same type as

the type of the item at 'ea'. If the byte at 'ea' is undefined, then

this function will create an array of bytes. How can I do that? Thanks.

MakeArray() works only on linear address and not on stack variables as shown above.

How can it be done? Thanks.

2 Answers 2

1

As far as I remember you need to modify stack frame of the function in order to achieve your goal.

Stack frame in IDA is represented by the structure which has its own id and type. In order to get this structure id you need you can use idc.get_frame_id
In order to get structure itself in newer API (IDA 7.0 + if I remember it correctly) you can use ida_frame.get_frame

After getting either frame id or the structure, you can modify it.

If you are working with structure, you can modify it with functions from module ida_struct.

If you are working with structure ID, you can use idc.add_struc_member.

You'll probably need to delete members of the frame occupying the required space first.

2
  • MakeArray() needs an ea as parameter, can it work on structure? how can I extract the ea of a struct variable? Commented Jul 30, 2019 at 11:16
  • 1
    @Kinetics332: use the struct member id as ea
    – Igor Skochinsky
    Commented Aug 1, 2019 at 8:21
1

The following worked for me on IDA 7.2:

  1. Get the frame id and confirm it's sane.
Python> frame_id = get_frame_id(get_name_ea(BADADDR, 'sub_5450'))
Python> print(list(StructMembers(frame_id)))
[(0L, 'var_18', 8L), (12L, 'var_C', 4L), (24L, ' r', 8L)]
  1. Get the existing variable id.
Python> var_id = get_member_id(frame_id, 12)

If I needed a new variable, I would have used add_struc_member(frame_id, 'var_name', var_offset, FF_DATA | FF_BYTE, -1, 1) first.

  1. Use apply_type in order to turn the variable into an array.
Python> apply_type(var_id, parse_decl('int[2]', 0))
True

Somehow MakeArray did not work:

Python> MakeArray(var_id, 2)
False

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.