So let's say we have the following code:

0: lea rax, [rbp+8]
1: mov rcx, rax
2: mov rdx, 5
3: call my_fun

i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in this case.

I tried getting the addresses of the arguments with:

addrs = idaapi.get_arg_addrs(3)

but that returns the address of mov rcx, rax. From that i would need something like the use-definition chain on rax, which i couldn't find if supported by ida.

my ultimate goal is to cast all the arguments to my_fun calls to a specific type. so here, i want to change the type of the local var [ebp+8] to another type

  • 1
    Do you want to use the Hex-Rays decompiler, or do you want to use IDA? The options are different for those two cases. Hex-Rays offers more options. Nov 16, 2022 at 17:35
  • i have access to the hex-rays decompiler, i presume that would be the easier/more complete solution? Interested to also see a high level overview of how you would approach this with just ida, would that involve scripting something like a dataflow analysis module?
    – xar3
    Nov 17, 2022 at 13:29


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.