3

Spotted an interesting problem when trying to determine which type of structure (since isStruct(getFlags(ea)) returns True) is defined at the given address in the DB. Reading through idc.py didn't help much.

  • Define a struct in the "structures" window.
  • It gets assigned a struct ID, so, it can be accessed from IDC/Python scripts.
  • Now, define a struct variable somewhere in e.g. the .data section.

A solid example:

# Some Python code
strid = idaapi.get_struc_id('_s__RTTIClassHierarchyDescriptor')
size = idaapi.get_struc_size(strid)
idaapi.doStruct(ea, size, strid)

How, knowing the ea, do I get the strid value ?

3
  • 1
    What is your question ? What problem did you spot ?
    – w s
    Jun 24, 2014 at 14:14
  • I didn't get what is the problem ?!?
    – perror
    Jun 24, 2014 at 14:19
  • Updated the question. Jun 25, 2014 at 11:01

3 Answers 3

8
+50

This works for me:

ea=here()
ti = idaapi.opinfo_t()
f = idc.GetFlags(ea)
if idaapi.get_opinfo(ea, 0, f, ti):
   print ("tid=%08x - %s" % (ti.tid, idaapi.get_struc_name(ti.tid)))

So ti.tid then contains the strid.

7
  • Confirmed working. Likely because IDA treats the structure variable as an "operand" of some "instruction". Jul 2, 2014 at 18:03
  • Sorry, there is 1 day timeout for bounties. :-( Jul 2, 2014 at 18:03
  • Looks like the bounty is still open. imgur.com/d0NYZSq.jpg Jul 2, 2014 at 19:04
  • Can't award earlier than 24h after starting the bounty, it seems. :-( Will do so ASAP. Jul 3, 2014 at 7:33
  • There we go, awarded! :-) Jul 3, 2014 at 13:35
2

in IDC the following works, so I'm not sure if you can use the same functions from Python

auto type;
auto ea;

ea = 0x8F84C37C;
Message("isStruct: %d\n", isStruct(GetFlags(ea)));
type = GetTinfo(ea);
Message("firstattr: %s\n", firstattr(type));
Message("getattr: %d\n", getattr(type,"typid"));

outputting:

isStruct: 1
firstattr: typid
getattr: 52541
4
  • Doesn't seem to work for me from Python... even if using IDC adapter funcs from idc.py. To be fair, copying your snippet into an IDC script and executing it indeed works. :-) Python>print idc.isStruct(idc.GetFlags(0x561114)) True Python>print idc.GetTinfo(0x561114) None Python>print idc.GetType(0x561114) None Sorry for this unreadable blob, I seem unable to insert line breaks in comments, but you probably get the idea of what's returned. Jun 26, 2014 at 7:15
  • That seems broken that the Python IDC wrapper for GetTinfo gets different results. Jun 26, 2014 at 7:23
  • idc.GetTinfo appears to just be calling idaapi.idc_get_type_raw(ea), but it's strange that it's failing. looking at swig/typeinf.i idc_get_type_raw appears to call get_tinfo so I'd expect it to work. Jun 26, 2014 at 8:01
  • Oddly enough: Python>tif = idaapi.tinfo_t() Python>print tif <idaapi.tinfo_t; proxy of <Swig Object of type 'tinfo_t *' at 0x02A5BFB0> > Python>print idaapi.get_tinfo2(0x561114, tif) False and Python>tp = idaapi.qtype() Python>flags = idaapi.qtype() Python>print idaapi.get_tinfo(0x561114, tp, flags) False so either those are broken, or I am doing it wrong (together with idapython, apparently). Jun 26, 2014 at 8:31
0

Updated version of @Willem Hengeveld answer for IDA 7.4 API:

address=0x14001D020
struct_id = idaapi.opinfo_t()
flags = ida_bytes.get_flags(address)
if ida_bytes.get_opinfo(struct_id, address, 0, flags):
    struct_name = ida_struct.get_struc_name(struct_id.tid)
    print (f"tid=0x{struct_id.tid:08x} - {struct_name}")

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.