Results 1 to 6 of 6

Thread: IDA Pro IDC API Question

  1. #1

    IDA Pro IDC API Question

    Does anyone know if IDAPython API (or IDC) allows us to convert a local byte variable to a byte array? I cannot seem to find any API calls that will do it. For example, say we have var_1, which is a byte. I want to make it a byte array of size 6. In IDA, we simply right click and adjust the size in the stack frame.

    So far in script, I can get the variable and offset, and I can get the current size as well, using GetFrame, GetMemberOffset, and GetMemberSize. If I have already converted one to an array, GetMemberSize returns the correct size. However, there is no SetMemberSize function.

    A few ways I've tried:

    MakeArray - nothing seems to happen, and I'm not even sure where this would make it. You pass it ea, or the linear offset. This wouldn't apply to a functions stack frame.

    SetMemberType - tried this thinking I could just set the type with nitems = 6, but with no luck.

    Suggestions?
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    Teach, Not Flame Kayaker's Avatar
    Join Date
    Oct 2000
    Posts
    4,107
    Blog Entries
    5
    Does this help?

    http://zairon.wordpress.com/2008/02/15/idc-script-and-stack-frame-variables-length/

  3. #3
    <script>alert(0)</script> disavowed's Avatar
    Join Date
    Apr 2002
    Posts
    1,281
    SetMemberType(
    GetFrame(...),
    ...,
    FF_DATA | FF_BYTE,
    -1,
    6);

    The important thing is that you need to make sure that there is room for all 6 bytes in the stack. If this will cause an overlap with an existing variable, the call above will fail. (You'd need to delete the overlapping member first.)

  4. #4
    I ran across that wordpress blog posting while looking into the issue, and while it mentioned how to find the size of variables and whatnot, I still wasn't able to figure out how to adjust the variables.

    Hopefully the suggestion to delete other member variables first will work - when I tried SetMemberType previously I wasn't deleting the other variables, which may have led to the issue. I also ran into an issue with using -1 for the typeid in SetMemberType - the script failed to run and tossed an error (not sure what the exact error was). I think it ran ok when I used 0 (although it didn't actually do anything...). Will try later and see what happens.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  5. #5
    Sure enough, SetMemberType did the trick once I deleted the other variables that it collided with when changing to an array. DelStrucMember takes care of the deletion. Using -1 for typeid also worked and didn't toss errors this time. I guess the turn to array function in GUI is slightly different since it automatically deletes the colliding variables, whereas IDC requires that portion manually.

    Thanks for the help!
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  6. #6
    <script>alert(0)</script> disavowed's Avatar
    Join Date
    Apr 2002
    Posts
    1,281
    Another happy customer

Similar Threads

  1. Question about IDA
    By callan300 in forum Tools of Our Trade (TOT) Messageboard
    Replies: 4
    Last Post: July 16th, 2007, 01:25
  2. How To Ask A Question
    By LLXX in forum Off Topic
    Replies: 7
    Last Post: September 11th, 2006, 22:52
  3. Question about Nag's
    By dmx in forum Mini Project Area
    Replies: 3
    Last Post: April 3rd, 2005, 09:15
  4. PM Question
    By Newbie in forum Advanced Reversing and Programming
    Replies: 7
    Last Post: January 18th, 2001, 00:18
  5. Question
    By Dya-Blo in forum Advanced Reversing and Programming
    Replies: 8
    Last Post: December 17th, 2000, 16:11

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •