1

During the debugging I can see all the function's local variables in tab Locals (Debugger -> Debugger Windows -> Locals(HEXRAYS)). For example I have a struct variable

a1    0x891E1160:{pBuf=0x7FC52F20,size=0x100}

I would like to write a python script to dump such data into a file. The only thing I cannot understand is how to get value of local variable by it's name. It should be something like

fdump = open(filename, 'wb')
ptr = get_var('a1')['pBuf']
size = get_var('a1')['size']
buf = idc.GetManyBytes(ptr, size, True)
fdump.write(buf)
fdump.close()

Is there a function like get_var in idautils, idc, or idaapi?

1

This is not full solution, but probably will help (assuming that you have IDA 6.6+ version)

# Display user-defined local variable information
# First defined the visitor class
class dump_lvar_info_t(idaapi.user_lvar_visitor_t):

    def __init__(self):
        idaapi.user_lvar_visitor_t.__init__(self)
        self.displayed_header = False
        return

    def get_info_qty_for_saving(self):
        return 0

    def get_info_for_saving(self, lv):
        return False

    def handle_retrieved_info(self, lv):

        try:
            if not self.displayed_header:
                self.displayed_header = True;
                print "------- User defined local variable information"

            print "Lvar defined at %x" % (lv.ll.defea, )

            if len(str(lv.name)):
                print "  Name: %s" % (str(lv.name), )

            if len(str(lv.type)):
                #~ print_type_to_one_line(buf, sizeof(buf), idati, .c_str());
                print "  Type: %s" % (str(lv.type), )

            if len(str(lv.cmt)):
                print "  Comment: %s" % (str(lv.cmt), )
        except:
            traceback.print_exc()
        return 0

    def handle_retrieved_mapping(self, lm):
        return 0

    def get_info_mapping_for_saving(self):
        return None

# Now iterate over all user definitions
dli = dump_lvar_info_t();
idaapi.restore_user_lvar_settings(entry_ea, dli)

I don't remember where exactly this code originates from, probably from IDAPython sources on google code. Here you have iteration over variables, all the rest should be doable.

0

You can use the following function in order to get the local variable value by its name(IDA 7+):

import idc 
import ida_frame 
import ida_struct 

def get_local_var_value_64(loc_var_name):
    frame = ida_frame.get_frame(idc.here())
    loc_var = ida_struct.get_member_by_name(frame, loc_var_name)
    loc_var_ea = loc_var.soff + idc.GetRegValue("RSP")
    # In case the variable is 32bit, use get_wide_dword() instead:
    loc_var_value = idc.read_dbg_qword(loc_var_ea) 
    return loc_var_value

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.