4

Let's assume we have a function which has a following variables in it:

  • Local variables on stack of different types, including types defined in local types window
  • Local variables of different types mapped to registers
  • Function parameters of different types

I have 2 IDBs with the same function based on the same binary and I want to pass this data from one IDB to another. Let's also assume that I have a solution of passing related data types between databases.

I know that I can iterate the local variables in decompiled function by using user_lvar_visitor_t class. I also know that there is a function save_user_lvar_settings these variables by using of the same iterator class user_lvar_visitor_t.

I have the following questions regarding this:

  • Which data should I gather from the first database to create these variables in second database correctly (with IDAPython, IDA version is 6.8)?
  • How can I create these variables in the second database to make use of save_user_lvar_settings or restore_user_lvar settings (with IDAPython, IDA version is 6.8)?

Update: Before asking this question I reviewed the following IDA collaboration solutions:

  1. Collabreate
  2. ida2sql
  3. IDA toolbag
  4. IDAsynergy
  5. IDAsync

One more update

  1. Diaphora

And was not able to find solution for my problem in any them.

  • Not an answer but maybe of help: ida2sql, see github.com/zynamics/ida2sql-plugin-ida. You could have a look at how they treat variables. This may help you, at least, with the first question. – stackoverflowwww Jul 23 '15 at 5:05
  • Unfortunately they are not working with hexrays related data. However you are right, I had to update my question with a list of packages I reviewed before asking this question. – w s Jul 23 '15 at 6:01
  • Maybe Diaphora ? They do use the HexRays data when comparing databases. – tmr232 Jul 23 '15 at 10:41
  • @tmr232 Yes, they use HexRays, but I was unable to find how they passing local variables between databases. As far as I can see, they comparing 2 hex-rays decompilations on a base of AST tree comparison. – w s Jul 28 '15 at 9:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.