Find all x-ref with specific argument with IdaPython

Question

I have a function at 0xabcd that is called a few times like Func(1,2,3) and Func(4,4,5).

I want to find all the references where the third argument is 5.

import idautils
for f in list(idautils.XrefsTo(0xabcd)):

How can I get the third argument from all the x-ref with IDAPython?

Answer 1

As currently stated, there's no simple solution to such a general problem.

Static analysis is quite a complex subject and there are no generic solutions that are available out of the box.

A few basic examples of why this may be difficult are these:

1. Consider the case where the third argument to Func is a user supplied input. It is therefore impossible to know the value statically.

2. Moreover, a value may be derived from other external sources (the OS, the internet, etc).

3. Even when limiting to static programs, the code manipulating the variable before passing it on to Func may be complex and difficult to follow.

A naïve static solution may be a more viable solution. For example, a solution that assumes the third argument to Func is a hardcoded immediate value and not a variable, will require only little static analysis and can be achieved, although IDA is not best-suited for such tasks (I'd recommend you take a look at angr instead)

Alternatively, one might argue that debugging is a better solution, placing a break point on Func and parsing the arguments at call-time. This is again not IDA's forte but nowadays IDA's debugger is good enough to use for such a task.