This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import idc | |
import ida_frame | |
import ida_struct | |
def get_local_var_value_64(loc_var_name): | |
frame = ida_frame.get_frame(idc.here()) | |
loc_var = ida_struct.get_member_by_name(frame, loc_var_name) | |
loc_var_ea = loc_var.soff + idc.GetRegValue("RSP") | |
loc_var_value = idc.read_dbg_qword(loc_var_ea) # In case the variable is 32bit, use get_wide_dword() instead. | |
return loc_var_value |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import idc | |
import idautils | |
import idaapi | |
FUNCTIONS_REGISTERS = {"g_log": "rcx", "g_log_error": "rdx"} | |
def get_string_for_function(call_func_addr, register): | |
""" | |
:param start_addr: The function call address |