In Ida pseudo-code when I press at stack's variable I can see the place of this variable in stack.
char buffer[XXX]; // [sp+YYh]
How can I get that information (buffer size and place of this buffer in stack) in IDAPython?
Add a comment
|
1 Answer
You can do this using idapython - using ida_hexrays api:
ida_hexrays.init_hexrays_plugin()
for var in ida_hexrays.decompile(ea).get_lvars():
# offset
offset = -stack_size + var.get_stkoff()
# variable size
size = var.width
# variable type
type = var.tif
And in ida gui, you can see the comments beside declarations.
-
thank you! 1)
stack_sizeis not define, andvar.get_stkoff()gave me the offset fromrspwhy did I needstack_size? 2)How can I see all the xref of this variable ?– funcCommented Dec 16, 2020 at 8:07 -
1) in my case, i wanted an offset wrt to rbp, thus I used stack size (
idc.get_func_attr(ea, idc.FUNCATTR_FRSIZE)) to calculate the offset. 2) i'd map these offsets with the variables collected usingget_local_vars(ea, stack_size)and get their xrefs, as I am not aware of any way of getting xrefs using decompiler interface– R4444Commented Dec 16, 2020 at 17:11 -
thank you a lot , 1)I didn't find out how can I
use get_local_varsI have triedget_local_vars(0xaaaa,idc.get_func_attr(0xaaaa, idc.FUNCATTR_FRSIZE))but I got errorexpected 3 arguments, got 2)and when I looking athelp(get_local_vars)I seeget_local_vars(prov , ea, out) -> bool, can you please show me an example? (2) isget_local_varsis better thanida_hexrays.decompile(ea).get_lvars()if I only want to get the stack struct ? what is the diffrence?– funcCommented Dec 17, 2020 at 5:02 -
hello, can u please ask a separate question with an example of what u would like to do? (as this seems independent or unrelated from your original question and their it'd be easier for someone to answer and you may get a quicker reply). 1) can u show an example code? 2) ida_hexrays uses decompiler interface and algorithm to infer types, and the former is without decompiler– R4444Commented Dec 18, 2020 at 1:04