Skip to content

How to get possible values of a stack var? #4285

Answered by CouleeApps
d0mnik asked this question in API
Discussion options

You must be logged in to vote

You can use LowLevelILInstruction.get_possible_stack_contents_after / MediumLevelILInstruction.get_possible_stack_contents_after to find possible stack values after an LLIL/MLIL instruction. You can use Function.get_low_level_il_here to look up an LLIL instruction at whatever address you want to inspect.

>>> current_function.get_low_level_il_at(here)
<llil: [ebp - 4 {var_8_3}].d = 1>
>>> current_function.get_low_level_il_at(here).get_possible_stack_contents_after(-8, 4)
<const 0x1>

Replies: 1 comment

Comment options

You must be logged in to vote
0 replies
Answer selected by plafosse
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
2 participants