Skip to content

Instantly share code, notes, and snippets.

@gdbinit
Created January 23, 2018 19:16
Show Gist options
  • Save gdbinit/3c2022907af5ca476173985492d6ec6e to your computer and use it in GitHub Desktop.
Save gdbinit/3c2022907af5ca476173985492d6ec6e to your computer and use it in GitHub Desktop.
Retrieve IDA stack variables cross references from IDA C SDK
/* retrieve the current function information - we need this to extract the stack frame */
func_t *current_function = get_func(current_addr);
/* retrieve the stack frame for this function - IDA encapsulates it as struc_t */
struc_t *frame = get_frame(current_function);
/* now each variable is a member of the structure - Chris Eagle book shows how to iterate over this */
for (int i = 0; i < frame->memqty; i++)
{
/* so each variable is a member - we can retrieve its netnode id via the .id field - in case of structures/stack variables
* this is an address starting by 0xFF but it's still a netnode like everything else in IDA
*/
member_t member = frame->members[i];
/* the juice is here - we can't simply do a get_first_dref_to with the id we got because that doesn't work
* we need to use the magic function build_stkvar_xrefs which will return a vector with all the references to the
* stack variable
*/
xreflist_t xrefs_list;
/* member is the variable - in this case we are iterating over all variables
* the variable name can be extracted using get_struc_name(member.id)).c_str() for example
*/
build_stkvar_xrefs(&xrefs_list, current_function, &member);
/* now just iterate over the vector and print the cross references to the stack variable */
for (xreflist_t::iterator it = xrefs_list.begin(); it != xrefs_list.end(); it++)
{
xreflist_entry_t &entry = *it;
msg("Cross refernce from 0x%llx", entry.ea);
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment