I always write ad-hoc code to get the values passed to function calls, like finding the XRef to a function and then tracking back disassembly to find some specific MOV or PUSH instruction. For example, in the following example:
.text:080488B1 push [ebp+gid] .text:080488B4 push [ebp+gid] ; gid .text:080488B7 call setregid
I would find the XRefs to setregid and then find "push instructions". Or, in the next example:
LOAD:FFFFFFFF824047A4 mov rdi, exec_map LOAD:FFFFFFFF824047AC mov esi, 40400h LOAD:FFFFFFFF824047B1 call kmem_alloc_wait
I would find the XRef to kmem_alloc_wait and then find before that call the values set to the registers RDI, RSI, RDX, RCX... And for each new processor, I would have to re-write again my code to handle the specific calling convention(s) of that CPU or VM. However, I'm sure there must be some proper way of getting the argument values to function calls, from IDAPython, in a CPU agnostic way.
So, do you know any way of getting the values passed to a function call from IDAPython that doesn't rely on parsing disassembly?