Accesssing xmm registers in IDAPython

Question

I'm trying to write a Python script for IDA that hooks into debugging events, and prints some info about the xmm registers. I tried

idc.GetRegValue("xmm0")

But that returns a random long, which changes every time I call the function. I looked at the source, and it looks like GetRegValue is always returning an integer value.

So I tried running the underlying code directly:

rv = idaapi.regval_t()
idaapi.get_reg_val("xmm0", rv)
print (rv.fval)

Which prints:

<Swig Object of type 'UINT16 *' at 0x073E1F08>

There does not appear to be a way to extract a float from that either.

So how do I actually get the value of an xmm register?

Answer 1

rv = idaapi.regval_t()
idaapi.get_reg_val("xmm0", rv)
print (rv.bytes().encode('hex'))

This will give you the raw 256 bit value of the xmm0 register. Depending on how the program you're debugging is using the register, this might contain various things. In my case, the code I'm debugging uses it as 4 floating point values. To parse them:

import struct
print(struct.unpack('ffff', rv.bytes()))

if your debuggee is using the register as two doubles, you would use 'dd' instead of 'ffff'.

In general, look up the SDK documentation instead of the (not very good) IDAPython documentation. Here's the relevant page for this: https://www.hex-rays.com/products/ida/support/sdkdoc/structregval__t.html