2

I can make an array using MakeArray.

Is there a function to get the size of the array I've created?

I've tried GetArrayId + GetLastIndex but it doesn't seem to work.

4
  • Can you add a sample C or assembly code that you have tried on?
    – Biswapriyo
    Aug 7, 2019 at 15:45
  • by "size" do you mean total byte size or number of elements?
    – Igor Skochinsky
    Aug 7, 2019 at 17:21
  • @IgorSkochinsky, actually I'm trying to get both. Aug 14, 2019 at 5:38
  • @Biswapriyo. I don't have a sample C or assembly code but you can try something like MakeArray(ea,10) to create an array then use GetArrayID + GetLastIndex. Aug 14, 2019 at 5:38

1 Answer 1

3

An array is an example of a data item. Like all items in IDA (the other item type is instruction), it has a starting address (head) and size. You can retrieve the whole item's size using the function get_item_size() (legacy name ItemSize()).

To figure out the number of items in an array, you can divide the whole array's size by the size of one element. But how to know the size of element? For this you need to inspect the flags of the item (attached to the head byte) using get_flags() function. Base item type is encoded in the bits defined by the DT_TYPE bits (top 4 bits of the flags) and takes values such as FF_BYTE (byte), FF_WORD (word), FF_DWORD and so on. But instead of checking the bits manually, you can use the function get_data_elsize() which return the size in bytes from the flags.

For more info check the bytes.hpp header in the SDK.

5
  • Thanks @IgorSkochinsky. This was exactly what I did! Almost... s_id = GetVarStrucId(ea) s_size = GetStrucSize(s_id) item_size = idaapi.get_item_size(ea) num_elements = s_size/item_size Aug 15, 2019 at 13:15
  • yes, if your items are sructs you need to get the struct id to determine its size
    – Igor Skochinsky
    Aug 15, 2019 at 13:20
  • @IgorSkochinsky how to do this for stack variables? For example, I have a stack variable: it's an array of 2 DWORD variables. I don't have effective address for them. I can't find it in the documentation: the functions you provided require the effective address.
    – KulaGGin
    Feb 6, 2022 at 13:45
  • 1
    @KulaGGin you can use the struct member ID instead of the ea. you need to get the frame struct and check it’s members.
    – Igor Skochinsky
    Feb 6, 2022 at 13:48
  • Thanks for such a quick answer. I tried it yesterday and it worked.
    – KulaGGin
    Feb 7, 2022 at 10:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.