4

Spotted an interesting problem when trying to determine which type of structure (since isStruct(getFlags(ea)) returns True) is defined at the given address in the DB. Reading through idc.py didn't help much.

  • Define a struct in the "structures" window.
  • It gets assigned a struct ID, so, it can be accessed from IDC/Python scripts.
  • Now, define a struct variable somewhere in e.g. the .data section.

A solid example:

# Some Python code
strid = idaapi.get_struc_id('_s__RTTIClassHierarchyDescriptor')
size = idaapi.get_struc_size(strid)
idaapi.doStruct(ea, size, strid)

How, knowing the ea, do I get the strid value ?

Improve this question
3
  • 1
    What is your question ? What problem did you spot ?
    – w s
    Jun 24, 2014 at 14:14
  • I didn't get what is the problem ?!?
    – perror
    Jun 24, 2014 at 14:19
  • Updated the question.
    – Dmitry Janushkevich
    Jun 25, 2014 at 11:01

3 Answers 3

Reset to default
9
+50

This works for me:

ea=here()
ti = idaapi.opinfo_t()
f = idc.GetFlags(ea)
if idaapi.get_opinfo(ea, 0, f, ti):
   print ("tid=%08x - %s" % (ti.tid, idaapi.get_struc_name(ti.tid)))

So ti.tid then contains the strid.

Improve this answer
7
  • Confirmed working. Likely because IDA treats the structure variable as an "operand" of some "instruction".
    – Dmitry Janushkevich
    Jul 2, 2014 at 18:03
  • Sorry, there is 1 day timeout for bounties. :-(
    – Dmitry Janushkevich
    Jul 2, 2014 at 18:03
  • Looks like the bounty is still open. imgur.com/d0NYZSq.jpg
    – Zach Riggle
    Jul 2, 2014 at 19:04
  • Can't award earlier than 24h after starting the bounty, it seems. :-( Will do so ASAP.
    – Dmitry Janushkevich
    Jul 3, 2014 at 7:33
  • There we go, awarded! :-)
    – Dmitry Janushkevich
    Jul 3, 2014 at 13:35
3

in IDC the following works, so I'm not sure if you can use the same functions from Python

auto type;
auto ea;

ea = 0x8F84C37C;
Message("isStruct: %d\n", isStruct(GetFlags(ea)));
type = GetTinfo(ea);
Message("firstattr: %s\n", firstattr(type));
Message("getattr: %d\n", getattr(type,"typid"));

outputting:

isStruct: 1
firstattr: typid
getattr: 52541
Improve this answer
4
  • Doesn't seem to work for me from Python... even if using IDC adapter funcs from idc.py. To be fair, copying your snippet into an IDC script and executing it indeed works. :-) Python>print idc.isStruct(idc.GetFlags(0x561114)) True Python>print idc.GetTinfo(0x561114) None Python>print idc.GetType(0x561114) None Sorry for this unreadable blob, I seem unable to insert line breaks in comments, but you probably get the idea of what's returned.
    – Dmitry Janushkevich
    Jun 26, 2014 at 7:15
  • That seems broken that the Python IDC wrapper for GetTinfo gets different results.
    – Simeon Pilgrim
    Jun 26, 2014 at 7:23
  • idc.GetTinfo appears to just be calling idaapi.idc_get_type_raw(ea), but it's strange that it's failing. looking at swig/typeinf.i idc_get_type_raw appears to call get_tinfo so I'd expect it to work.
    – Simeon Pilgrim
    Jun 26, 2014 at 8:01
  • Oddly enough: Python>tif = idaapi.tinfo_t() Python>print tif <idaapi.tinfo_t; proxy of <Swig Object of type 'tinfo_t *' at 0x02A5BFB0> > Python>print idaapi.get_tinfo2(0x561114, tif) False and Python>tp = idaapi.qtype() Python>flags = idaapi.qtype() Python>print idaapi.get_tinfo(0x561114, tp, flags) False so either those are broken, or I am doing it wrong (together with idapython, apparently).
    – Dmitry Janushkevich
    Jun 26, 2014 at 8:31
1

Updated version of @Willem Hengeveld answer for IDA 7.4 API:

address=0x14001D020
struct_id = idaapi.opinfo_t()
flags = ida_bytes.get_flags(address)
if ida_bytes.get_opinfo(struct_id, address, 0, flags):
    struct_name = ida_struct.get_struc_name(struct_id.tid)
    print (f"tid=0x{struct_id.tid:08x} - {struct_name}")
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.