In Ida pseudo-code when I press at stack's variable I can see the place of this variable in stack.

char buffer[XXX]; // [sp+YYh]

How can I get that information (buffer size and place of this buffer in stack) in IDAPython?

1 Answer 1


You can do this using idapython - using ida_hexrays api:

for var in ida_hexrays.decompile(ea).get_lvars():
    # offset
    offset = -stack_size + var.get_stkoff()
    # variable size
    size = var.width
    # variable type
    type = var.tif

And in ida gui, you can see the comments beside declarations.

enter image description here

  • thank you! 1)stack_size is not define, and var.get_stkoff() gave me the offset from rsp why did I need stack_size ? 2)How can I see all the xref of this variable ?
    – func
    Dec 16, 2020 at 8:07
  • 1) in my case, i wanted an offset wrt to rbp, thus I used stack size (idc.get_func_attr(ea, idc.FUNCATTR_FRSIZE)) to calculate the offset. 2) i'd map these offsets with the variables collected using get_local_vars(ea, stack_size) and get their xrefs, as I am not aware of any way of getting xrefs using decompiler interface
    – R4444
    Dec 16, 2020 at 17:11
  • thank you a lot , 1)I didn't find out how can I use get_local_vars I have tried get_local_vars(0xaaaa,idc.get_func_attr(0xaaaa, idc.FUNCATTR_FRSIZE)) but I got error expected 3 arguments, got 2) and when I looking at help(get_local_vars) I see get_local_vars(prov , ea, out) -> bool, can you please show me an example? (2) is get_local_vars is better than ida_hexrays.decompile(ea).get_lvars() if I only want to get the stack struct ? what is the diffrence?
    – func
    Dec 17, 2020 at 5:02
  • hello, can u please ask a separate question with an example of what u would like to do? (as this seems independent or unrelated from your original question and their it'd be easier for someone to answer and you may get a quicker reply). 1) can u show an example code? 2) ida_hexrays uses decompiler interface and algorithm to infer types, and the former is without decompiler
    – R4444
    Dec 18, 2020 at 1:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.