0

I am using IDA Demo (evaluation version >7). I have a binary:

#include <stdbool.h>
int do_decode(){}
int main()
{
  bool decode = false;
  char opt = getopt();
  switch (opt)
  {
    case 'd':
      decode =true;
      break;
    default:
      break;
  }
  if (decode) do_decode();
}

Is there any way to get variable information using IDA?

  1. if debug information is available
  2. stripped and optimized

I couldn't get variable type information in either case. For e.g. what I get from radare2:

[0x004004b9]> afv
var int64_t var_2h @ rbp-0x2
var uint32_t var_1h @ rbp-0x1

This is far from perfect, but at least something.

Here is my IDA textview:

; =============== S U B R O U T I N E =======================================
.text:00000000004004B9
.text:00000000004004B9 ; Attributes: bp-based frame
.text:00000000004004B9
.text:00000000004004B9 ; int __fastcall main(int, char **, char **)
.text:00000000004004B9 main            proc near               ; DATA XREF: start+1D↑o
.text:00000000004004B9
.text:00000000004004B9 var_2           = byte ptr -2
.text:00000000004004B9 var_1           = byte ptr -1
.text:00000000004004B9
.text:00000000004004B9                 push    rbp
.text:00000000004004BA                 mov     rbp, rsp
.text:00000000004004BD                 sub     rsp, 10h
.text:00000000004004C1                 mov     [rbp+var_1], 0
.text:00000000004004C5                 mov     eax, 0
.text:00000000004004CA                 call    _getopt
.text:00000000004004CF                 mov     [rbp+var_2], al
.text:00000000004004D2                 movsx   eax, [rbp+var_2]
.text:00000000004004D6                 cmp     eax, 64h ; 'd'
.text:00000000004004D9                 jnz     short loc_4004E1
.text:00000000004004DB                 mov     [rbp+var_1], 1
.text:00000000004004DF                 jmp     short loc_4004E2
0
.text:00000000004004B9 opt             = byte ptr -2
.text:00000000004004B9 decode          = byte ptr -1

^ Isn't that part what you're looking for?

var int64_t var_2h @ rbp-0x2
var uint32_t var_1h @ rbp-0x1

Additionally, IDA correctly detected that those local variables only occupy one byte each, whereas radare2 thought there are 64 and 32-bit integers (even though their offset on the stack differs by only one byte).

You could also get this information programatically, but unfortunately IDAPython is not available in the evaluation version.

|improve this answer|||||
  • thanks for your reply. In case of radare, it gives you a specific type - int64_t. I want similar type information from IDA. – R4444 Mar 21 at 16:05
  • The name doesn't really matter. In the section I highlighted, you get the size of the type (byte/word/dword/qword). The only thing missing is the signedness. Plus the type information from radare is wrong, since your decode variable is a bool and opt a char. – neat Mar 21 at 16:31
  • I think it does matter in case we want to distinguish between say - type bool and char - I believe both of size byte. You are right that the types radare gives are wrong. I just wanted to check if IDA distinguishes between such small types and give me better results. In short, if IDA is capable of giving me better type inference. – R4444 Mar 21 at 16:35
  • I'm afraid you can't get more information that what is shown here or in the Stack Variables view (that is shown when double-clicking a local variable), without needing the Hex-Rays decompiler. – neat Mar 21 at 17:14
  • Thanks so much for your reply! that helps a lot. – R4444 Mar 21 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.