0

I have a decompiled result from calling idaapi.decompile().

From the decompiled result, I obtain the treeitems and loop through them looking for items that are of type cexpr_t and have the opname of "call".

I can then grab the argument list (carglist_t) and I can easily see that I have the call I am looking for based on the number of carg_t items in the list.

What I would like to get is the text belonging to the carg_t object. If I call 'string', it returns None.

How can I do this?

I know that the text can be generated because I can call get_pseudocode on the decompiled result and print the lines of the function. However, I wanted to avoid parsing the function call text and instead have IDA give me each argument since it has already done all of the required parsing.

If it matters, I am running IDA 6.9.

1

You can get the string based on the carg_t's element type (its ctype_t).

Let's assume that your carg_t instance is a variable named arg. Then for example, if arg.op == cot_var then the argument's element type is a local variable. You'd get arg's lvars_t index via arg.v.idx and you can then get that variable's name as follows:

func.get_lvars()[arg.v.idx].name
| improve this answer | |
  • I can confirm that worked for this case. What if the carg_t instance is a cot_cast or a cot_obj? When it is a cot_cast, it will probably look like (char*)&unk_123456 and I need that text so I can parse out the 123456 which will likely be the memory address of a string. When it is a cot_obj, it is likely to be a static string and it is the string that I want. – ericg May 18 '16 at 12:58
  • For cot_obj, in my case, the answer appears to be idc.GetString( cargtVar.obj_ea, -1, idc.ASCSTR_C ). I am finding the information in part from hex-rays.com/products/decompiler/manual/sdk/… in the Public Attributes section. I am still working on cot_cast. – ericg May 18 '16 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.