1

I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line:

ida_typeinf.get_arg_addrs(call_address)  # call address points at `call some_func`

For some reason, the call always returns None. Is there any other way to do this?

2 Answers 2

1

I have found out that if in the disassembler you give the type to the function that is being called, then the ida python function will work as it should.

1

Okay that's our sample code:

.text:0000000180002953                 lea     rcx, aSmiGetplatform ; "SMI_GetPlatformInfo"
.text:000000018000295A                 mov     r12b, 0FFh
.text:000000018000295D                 mov     ebx, 0FFFFh
.text:0000000180002962                 call    DBG_Func

Ida Python shell we enter:

Python> type ( idaapi.get_arg_addrs( 0x180002962 ) )
<class 'NoneType'>

And there it is That 'none' is the problem. Let's fix it.

Place cursor in 'DBG_Func' and press 'y' (or click Edit/Functions/Set Type) it says:

void __fastcall DBG_Func();

Isn't DBG_Func supposed to receive and argument? Well so the function type definition is wrong. Change it to

void __fastcall DBG_Func(char *FunctionNameText);

and now test it again

Python> type (idaapi.get_arg_addrs( 0x180002962 ))
<class 'list'>

or

Python> idaapi.get_arg_addrs( 0x180002962 )
[0x180002953]

Wow finally problem solved! At 0x180002953 there is the argument that is passed to the call.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.