1

I am using idapro 7.5 to get variable information from binaries.

Consider following simple code:

#include <stdio.h>
#include <stdlib.h>

int main(int argc, char *argv[])
{
  int i, N, array[10];

  N = atoi(argv[10]);

  array[N] = N;
  array[12] = N;
  array[0] = 8;

  for(i=0 ; i<N ; i++)
    array[i] = N;

  printf("%d %d\n", array[12], array[5]);
  return 0;
}

Using idapython, I can get function information like stack variables, their sizes, types, etc. using something like -

for ea in idautils.Functions():
    for mem in ida_struct.get_struc(idc.get_frame_id(ea)).members:
        name = ida_struct.get_member_name(mem.id)
        size = ida_struct.get_member_size(mem)
        offset = mem.get_soff()

Similarly, I can get global variable information like their name and addresses.

Now, this works fine (particularly in above binary) and I can get array with a size of 12 on correct offset (this makes sense, as I have compiled binary using -g).

But, when I strip the binary, I can't get array size correctly with the above code (this is expected). When I use hex rays -

enter image description here

Here, ida decompiler was able to recover correct array bounds using decompiler algorithms. And I can also synchronize this with disassembly interface using Synchronize with option in Gui (I assume synchronize function is used to apply predicted types or other information to disassembly interface - I maybe wrong here, please forgive my ignorance).

I would like to know if there is any way I can do that using idapython (I can see some endpoints like sync_sources in ida_kernwin), so that I can use the above code to get variable properties predicted using hex rays. I am familiar with ghidra and you can apply ghidra decompiler predictions to the listing analysis (just like synchronization in ida) using:

HighFunctionDBUtil.commitLocalsToDatabase(high_func, SourceType.ANALYSIS)

Thus variables get updated in the analysis.

Edit: I can manually get function variables using hexrays decompiler interface like -

def get_local_vars(ea, stack_size):
    # can be used to get member size, type, etc.
    for var in ida_hexrays.decompile(ea).get_lvars():
        print(var.name)
        print(-stack_size + var.get_stkoff())
        print(var.width)

Still, I was not able to find an automatic way to apply hexrays decompiler interface or sync hexrays decompiler interface with disassembly interface.

7
  • 1
    You're going to have to be more specific about what you want. Generally speaking, it's not always possible to take the type information from Hex-Rays' stack variables and apply it to the disassembly stack frame. There are two main reasons for this, off the top of my head: mapped variables eliminating Hex-Rays stack variables, and forced variables creating more than one variable at a single stack location. Commented Oct 9, 2020 at 23:57
  • Rolf, Thanks for your reply, in short I want to use type (mostly array bounds) information predicted by hexrays, in case of stripped binaries. I am aware of the reasons you mentioned. but, I am doing this to check what results i could get on certain benchmarks. Also, as there is an option for sync in gui, I am interested in checking it's capability.
    – R4444
    Commented Oct 10, 2020 at 1:59
  • Also, please note that I assumed "synchronization" means applying hexrays predicted information to disassembly interface, if this is not true then forgive my ignorance
    – R4444
    Commented Oct 10, 2020 at 3:43
  • 1
    “Synchronize with” only syncs the cursor location in both views.
    – Igor Skochinsky
    Commented Oct 10, 2020 at 11:39
  • ahh, thanks Igor, in that case, "synchronize with" is not what I want to do. I'd like to "apply" decompiler predictions to the disassembly interface. Is this automatically possible at all?
    – R4444
    Commented Oct 10, 2020 at 13:53

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.