4

Spotted an interesting problem when trying to determine which type of structure (since isStruct(getFlags(ea)) returns True) is defined at the given address in the DB. Reading through idc.py didn't help much.

  • Define a struct in the "structures" window.
  • It gets assigned a struct ID, so, it can be accessed from IDC/Python scripts.
  • Now, define a struct variable somewhere in e.g. the .data section.

A solid example:

# Some Python code
strid = idaapi.get_struc_id('_s__RTTIClassHierarchyDescriptor')
size = idaapi.get_struc_size(strid)
idaapi.doStruct(ea, size, strid)

How, knowing the ea, do I get the strid value ?

  • 1
    What is your question ? What problem did you spot ? – w s Jun 24 '14 at 14:14
  • I didn't get what is the problem ?!? – perror Jun 24 '14 at 14:19
  • Updated the question. – Dmitry Janushkevich Jun 25 '14 at 11:01
7
+50

This works for me:

ea=here()
ti = idaapi.opinfo_t()
f = idc.GetFlags(ea)
if idaapi.get_opinfo(ea, 0, f, ti):
   print ("tid=%08x - %s" % (ti.tid, idaapi.get_struc_name(ti.tid)))

So ti.tid then contains the strid.

2

in IDC the following works, so I'm not sure if you can use the same functions from Python

auto type;
auto ea;

ea = 0x8F84C37C;
Message("isStruct: %d\n", isStruct(GetFlags(ea)));
type = GetTinfo(ea);
Message("firstattr: %s\n", firstattr(type));
Message("getattr: %d\n", getattr(type,"typid"));

outputting:

isStruct: 1
firstattr: typid
getattr: 52541
  • Doesn't seem to work for me from Python... even if using IDC adapter funcs from idc.py. To be fair, copying your snippet into an IDC script and executing it indeed works. :-) Python>print idc.isStruct(idc.GetFlags(0x561114)) True Python>print idc.GetTinfo(0x561114) None Python>print idc.GetType(0x561114) None Sorry for this unreadable blob, I seem unable to insert line breaks in comments, but you probably get the idea of what's returned. – Dmitry Janushkevich Jun 26 '14 at 7:15
  • That seems broken that the Python IDC wrapper for GetTinfo gets different results. – Simeon Pilgrim Jun 26 '14 at 7:23
  • idc.GetTinfo appears to just be calling idaapi.idc_get_type_raw(ea), but it's strange that it's failing. looking at swig/typeinf.i idc_get_type_raw appears to call get_tinfo so I'd expect it to work. – Simeon Pilgrim Jun 26 '14 at 8:01
  • Oddly enough: Python>tif = idaapi.tinfo_t() Python>print tif <idaapi.tinfo_t; proxy of <Swig Object of type 'tinfo_t *' at 0x02A5BFB0> > Python>print idaapi.get_tinfo2(0x561114, tif) False and Python>tp = idaapi.qtype() Python>flags = idaapi.qtype() Python>print idaapi.get_tinfo(0x561114, tp, flags) False so either those are broken, or I am doing it wrong (together with idapython, apparently). – Dmitry Janushkevich Jun 26 '14 at 8:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.