Let's consider a code snippet:

enter image description here

I can get disassembler variables-

def get_function_vars(function) -> list:
    frameId = idc.get_frame_id(function)
    if frameId:
        varStruct = ida_struct.get_struc(frameId)
        if varStruct:
            return [mem for mem in varStruct.members]
    return []

And instruction references-

def get_variable_refs(function, mem) -> ida_frame.xreflist_t():
    xrefs = ida_frame.xreflist_t()
    ida_frame.build_stkvar_xrefs(xrefs, function, mem)
    return [xref.ea for xref in xrefs]

This gives me instructions referred by say - "var_38" -> 2017BB and 2017E6.

I found that I can get hex rays variables by doing something like-

def get_hexrays_vars(ea) -> dict:
    hexrays_types = {}
        decompiled = ida_hexrays.decompile(ea)
    except ida_hexrays.DecompilationFailure:
        return {}
    if not decompiled:
        return {}
    for var in decompiled.get_lvars():

This prints -


Which aligns well with the decompiler view -

enter image description here

Now I want to get the instructions referred by these variables for e.g. one instruction reference for variable "V3" could be 2017D0 as "V3" is the register allocated variable in the register ebp.

One way to do this in binary ninja is for e.g.

for var in ins.vars_read:
    depd = [(func.mlil[i].address, ins.address) 
            for i in func.mlil.get_var_definitions(var) 
            if func.mlil[i].address != ins.address]
for var in ins.vars_written:
    depd += [(ins.address, func.mlil[i].address)
            for i in func.mlil.get_var_uses(var)
            if func.mlil[i].address != ins.address]

My end goal is to do some data flow analysis. And I thought this might be possible as decompiler is doing this anyways.

  • 1
    I highly recommend taking a look at gaasedelen's lucid plugin to visualize how the def-use chains (chain_t) are stored/used for the later decompilation passes before it gets converted to ctree. they're organized by mblock_t (as opposed to address), a micro-instruction (minsn_t) can be moved around or transformed depending on the operations done within a pass, and low-level information about the locations being affected by an operation are stored as intervals that either reference the parts of a register or memory location. Commented May 18, 2023 at 18:25
  • @AliRizvi-Santiago Thanks so much for the lead. I remember seeing this tool before. But, for sure, I will give it a try! thanks!
    – R4444
    Commented May 19, 2023 at 14:46


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.