I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so.What I am trying to achieve is a code like:xrefs = get_variable_references('arg_4') that will return the results corresponding with the GUI's results:Thanks in advance.
idapython - Get Xrefs to a stack variable
ida;disassembly;idapython;disassemblers;idapro sdk
There is one function that does this: build_stkvar_xrefs, defined in C++ but exposed via the Python SWIG bindings. IDA builds stack xrefs dynamically when you ask for it. In order to use the function, it requires a little bit of setup.You'll need to use a few functions to get what you need:get_func(ea): retrieves the func_t structure for the function at eaget_frame(func_t foo): returns the struct_t structure for thefunction frame specified by fooDecodeInstruction(ea): returns the inst_t representing instruction at eaget_stkvar(op_t op, sval_t v): op is a reference to an instruction, v is the immediate value in the operand. Usually you just use op.addr. It returns a tuple, (member_t, val). member_t is a pointer to the stack variable, which is what we need. val is the same value as the soff field in the member_t for the stack var. More on this later.xreflist_t(): creates a new xreflist of xreflist_entry_tbuild_stkvar_xrefs(xreflist_t xrefs, func_t func, member_t member): fills xrefs with xreflist_entry_t's that represent the stack var xrefs given by member in func.struct_t.get_member(x): You can use this method to iterate all stack variables in a frame to retrieve all member_t's. If you want to build xrefs for all stack variables, this is usually easier.Here's an example of how this all ties together:# 0x4012d0 is the function address# 0x4012dc is an instruction address referencing# a stack variable. It looks like:# mov [ebp - 4], ecxpFunc = get_func(0x4012d0)pFrame = get_frame(pFunc)inst = DecodeInstruction(0x4012dc)op = inst[0] #first operand references stack varpMember, val = get_stkvar(op, op.addr)xrefs = xreflist_t()build_stkvar_xrefs(xrefs, pFunc, pMember)for xref in xrefs:    print hex(xref.ea) #print xref address# Contrived member dictionary example.dictMem = dict()x = 0while(x < pFrame.memqty):    dictMem[GetMemberName(pFrame.id, pFrame.get_member(x).soff)] = pFrame.get_member(x)    x = x+1# given var name you can now use the# dictionary to grab the member_t to pass# to build_stkvar_xrefspMem = dictMem[var_4]xrefs = xreflist_t()build_stkvar_xrefs(xrefs, pFunc, pMem)for xref in xrefs:    print hex(xref.ea) #print xrefs to var_4soff isn't a stack offset. I think it means structure offset, and it's an offset into the frame structure so you can retrieve other bits of information. You'll need this field to use other stack variable related functions such as: SetMemberType, SetMemberName, GetMemberName, DelStrucMember, etc. So, for a simple on the fly variable name to xref lookup, you can do something like:def get_stack_xrefs(func_ea, var_name):    pFunc = get_func(func_ea)    pFrame = get_frame(pFunc)    pMember = None    result = []    while(x < pFrame.memqty):        if GetMemberName(pFrame.id, pFrame.get_member(x).soff) == var_name:           pMember = pFrame.get_member(x)           break;         x = x+1    if pMember:         xrefs = xreflist_t()        build_stkvar_xrefs(xrefs, pFunc, pMember)        for each in xrefs:            result.append(each.ea)    return resultIf you want more information on these functions, I recommend taking a look at the following modules from the IDA SDK documentation (in no particular order):funcs.hppframe.hppstruct.hppReference: https://www.hex-rays.com/products/ida/support/sdkdoc/files.html