Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  IDAPython get_stkvar() Problem

Topic created on: March 28, 2008 22:23 CDT by abuse007 .

Hi,

In an IDAPython script that I'm writing, I'm trying to get the stack variable referenced in an instruction's operand. Once I get the stack variable I'd like to rename it. I'm using the following code: -


op = get_instruction_operand ( cmd, n )
stackVar = get_stkvar ( op, op.addr, op.addr )



However this gives me the following error: -


    stackVar = get_stkvar ( op, op.addr, op.addr )
  File "C:\Program Files\IDA\python\idaapi.py", line 3347, in get_stkvar
    return _idaapi.get_stkvar(*args)
TypeError: in method 'get_stkvar', argument 3 of type 'sval_t *'


I have tried using 0 (zero) as the third argument, but still got the same error message.

I'm using IDA Pro 5.2 with IDAPython 0.9.55 final with Python 2.5.1 final.

I have read Steve Micallef's IDA Plug-in Writing in C/C++ tutorial, IDAPython's API Documentation, the IDA SDK header files, and a few example scripts. I haven't been able to find any scripts that use get_stkvar(), and even searching google for "get_stkvar" only returns the IDAPython API Documentation. I'm quite surprised, I'm guessing people use a different method to get the stack variables.

Any help would be appreciated. Thank you in advance.

  pedram     April 10, 2008 12:40.11 CDT
I tried a number of different ways to do this and can't get it to work either, will drop Gergely a line and see if he can post a response.

  erlend     April 11, 2008 01:00.08 CDT
The following code is working for me:

ua_ana0(ea)
inst = get_current_instruction()
op_t = get_instruction_operand(inst,opnr)
member_t = get_stkvar(op_t, op_t.addr, None)

That is, use None instead of 0 for the third argument.

  abuse007     April 11, 2008 03:15.58 CDT
Thanks Pedram and Erlend.

I will try None as the third argument and post back to confirm if it also works for me. Thank you for your help, I should have thought of None. Thank you very much.

  Dyce     April 12, 2008 06:31.39 CDT
> erlend: The following code is working for me:
>
> ua_ana0(ea)
> inst = get_current_instruction()
> op_t = get_instruction_operand(inst,opnr)
> member_t = get_stkvar(op_t, op_t.addr, None)
>
> That is, use None instead of 0 for the third argument.

That is one working option. In case you need to specify that
argument for whatever reason, it is now possible starting with
build 0.9.56. This snippet illustrates the, somewhat quirky,
way to use it:


from idaapi import *
ua_ana0(here())
op = get_instruction_operand(cvar.cmd, 1)
sv = sval_pointer()
sv.value = op.addr
m = get_stkvar(op, sv.value, sv.cast())
print hex(m.id), m.soff, m.eoff  


Please note that from this version on, you have import the
symbols from idaapi if you need them, it is no longer done
implicitly.

abuse007:
In the future, if you have an IDAPython-related problem you might
get an answer quicker through the mailing list as I get immediate
notification of those.

http://groups.google.com/group/idapython

Note: Registration is required to post to the forums.

There are 31,322 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit