IDA scripting - get local variable by its name

Question

During the debugging I can see all the function's local variables in tab Locals (Debugger -> Debugger Windows -> Locals(HEXRAYS)). For example I have a struct variable

a1    0x891E1160:{pBuf=0x7FC52F20,size=0x100}

I would like to write a python script to dump such data into a file. The only thing I cannot understand is how to get value of local variable by it's name. It should be something like

fdump = open(filename, 'wb')
ptr = get_var('a1')['pBuf']
size = get_var('a1')['size']
buf = idc.GetManyBytes(ptr, size, True)
fdump.write(buf)
fdump.close()

Is there a function like get_var in idautils, idc, or idaapi?

Answer 1

This is not full solution, but probably will help (assuming that you have IDA 6.6+ version)

# Display user-defined local variable information
# First defined the visitor class
class dump_lvar_info_t(idaapi.user_lvar_visitor_t):

    def __init__(self):
        idaapi.user_lvar_visitor_t.__init__(self)
        self.displayed_header = False
        return

    def get_info_qty_for_saving(self):
        return 0

    def get_info_for_saving(self, lv):
        return False

    def handle_retrieved_info(self, lv):

        try:
            if not self.displayed_header:
                self.displayed_header = True;
                print "------- User defined local variable information"

            print "Lvar defined at %x" % (lv.ll.defea, )

            if len(str(lv.name)):
                print "  Name: %s" % (str(lv.name), )

            if len(str(lv.type)):
                #~ print_type_to_one_line(buf, sizeof(buf), idati, .c_str());
                print "  Type: %s" % (str(lv.type), )

            if len(str(lv.cmt)):
                print "  Comment: %s" % (str(lv.cmt), )
        except:
            traceback.print_exc()
        return 0

    def handle_retrieved_mapping(self, lm):
        return 0

    def get_info_mapping_for_saving(self):
        return None

# Now iterate over all user definitions
dli = dump_lvar_info_t();
idaapi.restore_user_lvar_settings(entry_ea, dli)

I don't remember where exactly this code originates from, probably from IDAPython sources on google code. Here you have iteration over variables, all the rest should be doable.

Answer 2

You can use the following function in order to get the local variable value by its name(IDA 7+):

import idc 
import ida_frame 
import ida_struct 

def get_local_var_value_64(loc_var_name):
    frame = ida_frame.get_frame(idc.here())
    loc_var = ida_struct.get_member_by_name(frame, loc_var_name)
    loc_var_ea = loc_var.soff + idc.GetRegValue("RSP")
    # In case the variable is 32bit, use get_wide_dword() instead:
    loc_var_value = idc.read_dbg_qword(loc_var_ea) 
    return loc_var_value