So let's say we have the following code:

0: lea rax, [rbp+8]
1: mov rcx, rax
2: mov rdx, 5
3: call my_fun

i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in this case.

I tried getting the addresses of the arguments with:

addrs = idaapi.get_arg_addrs(3)

but that returns the address of mov rcx, rax. From that i would need something like the use-definition chain on rax, which i couldn't find if supported by ida.

my ultimate goal is to cast all the arguments to my_fun calls to a specific type. so here, i want to change the type of the local var [ebp+8] to another type

  • 1
    Do you want to use the Hex-Rays decompiler, or do you want to use IDA? The options are different for those two cases. Hex-Rays offers more options. Commented Nov 16, 2022 at 17:35
  • i have access to the hex-rays decompiler, i presume that would be the easier/more complete solution? Interested to also see a high level overview of how you would approach this with just ida, would that involve scripting something like a dataflow analysis module?
    – xar3
    Commented Nov 17, 2022 at 13:29


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.