In Ida pseudo-code when I press at stack's variable I can see the place of this variable in stack.

char buffer[XXX]; // [sp+YYh]

How can I get that information (buffer size and place of this buffer in stack) in IDAPython?


You can do this using idapython - using ida_hexrays api:

for var in ida_hexrays.decompile(ea).get_lvars():
    # offset
    offset = -stack_size + var.get_stkoff()
    # variable size
    size = var.width
    # variable type
    type = var.tif

And in ida gui, you can see the comments beside declarations.

enter image description here

  • thank you! 1)stack_size is not define, and var.get_stkoff() gave me the offset from rsp why did I need stack_size ? 2)How can I see all the xref of this variable ? – func Dec 16 '20 at 8:07
  • 1) in my case, i wanted an offset wrt to rbp, thus I used stack size (idc.get_func_attr(ea, idc.FUNCATTR_FRSIZE)) to calculate the offset. 2) i'd map these offsets with the variables collected using get_local_vars(ea, stack_size) and get their xrefs, as I am not aware of any way of getting xrefs using decompiler interface – R4444 Dec 16 '20 at 17:11
  • thank you a lot , 1)I didn't find out how can I use get_local_vars I have tried get_local_vars(0xaaaa,idc.get_func_attr(0xaaaa, idc.FUNCATTR_FRSIZE)) but I got error expected 3 arguments, got 2) and when I looking at help(get_local_vars) I see get_local_vars(prov , ea, out) -> bool, can you please show me an example? (2) is get_local_vars is better than ida_hexrays.decompile(ea).get_lvars() if I only want to get the stack struct ? what is the diffrence? – func Dec 17 '20 at 5:02
  • hello, can u please ask a separate question with an example of what u would like to do? (as this seems independent or unrelated from your original question and their it'd be easier for someone to answer and you may get a quicker reply). 1) can u show an example code? 2) ida_hexrays uses decompiler interface and algorithm to infer types, and the former is without decompiler – R4444 Dec 18 '20 at 1:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.