0

I have a simple program:

#include <stdio.h>

int main()
{
  int a;
  a = func(15, 3);
  return a;
}

int func(int i, int j)
{
  int b1[5], b2[10];

  b2[i] = 1;
  printf("%d\n", b1[j]);

  return 0;
}

I am using python script to get local variables from the stripped binary, compiled using above program.

I use: function.getLocalVariables() or something like function.getStackFrame().getStackVariables() to get the local variables. Interestingly I observed that, this script doesn't give me all the variables which can be seen in the decompiler window. For e.g., in the above case, I get following in the decompiled window (for function func):

image

Here, the predicted buffers can be seen. But instead I get:

FUN_004004d6
array(ghidra.program.model.listing.Variable, [[undefined4 local_5c@Stack[-0x5c]:4], [undefined4 local_60@Stack[-0x60]:4]])

which are clearly not the predicted buffers. Is there any way to get those buffers?

Note: I also posted the same on ghidra github's forum.

0

In case anyone wondering, I posted this question on ghidra github as well and @cetfor posted a very good way to do this. You can find that question here.

I tried to reproduce it and I was able to do this successfully.

from ghidra.app.decompiler import DecompileOptions
from ghidra.app.decompiler import DecompInterface

ifc = DecompInterface()
ifc.setOptions(DecompileOptions())
ifc.openProgram(currentProgram)

for function in functions:
    res = ifc.decompileFunction(function, 60, monitor)
    high_func = res.getHighFunction()
    lsm = high_func.getLocalSymbolMap()
    symbols = lsm.getSymbols()

    for i, symbol in enumerate(symbols):
      print("Symbol {}: {} (size: {})".format(i+1, symbol.getName(), symbol.size))

Check out this endpoint for more information on highfunction. Note that I found differences in variables given by this decompiler interface and listing. Also, I couldn't find any api endpoint which gives address references by these variables (something like getReferencesTo).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.