I am trying to learn the hexrays ctree api. I am using the python bindings.
The task I am trying to automate is tracing the arguments to wrmsr instructions.
I notice that hexrays represents them like this:
__writemsr(*(_DWORD *)SYSTEM_BUFFER, *((_QWORD *)SYSTEM_BUFFER + 1));
Using Hexrayscodexplorer I figured out that this is a "helper" expression:
helper __writemsr ea->FFFFFFFFFFFFFFFF void (__fastcall *)(unsigned int, unsigned __int64)
By the looks of the decompilation output, I expect I should be able to access the arguments to the "helper" (
*(_DWORD *)SYSTEM_BUFFER, *((_QWORD *)SYSTEM_BUFFER + 1) in this case) - however the spots where I would look for operands or function arguments for a function call (cot_call) aren't populated.
Is this possible to do?
I have so far tried to look for arguments in:
cexpr_t.x cexpr_t.y cexpr_t.a
I'm sure I just don't understand how these helper expressions work in IDA. Unfortunately the function I'm trying to analyze is nested very deeply in a huge function, so it's kind of hard to see how all of the trees work together in the ctrees graph view provided by Hexrayscodexplorer.
Are the arguments held in some other cexpr object? How do I get to them?