Struct StackSlot 

pub struct StackSlot { /* private fields */ }

One slot in a function’s stack frame, its frame-pointer-relative offset and byte size, plus a kind that is either a real variable (with name/type) or a reserved slot.

Implementations

impl StackSlot

pub const fn offset(&self) -> i64

The frame-pointer-relative offset IDA displays: negative below the frame pointer (locals), positive above it (the return address, then stack arguments).

Examples found in repository

examples/types.rs (line 146)

fn print_frame(frame: &StackFrame, ea: Address) {
    println!(
        "\n== stack frame: {ea:#x}  ({} bytes, {} slots) ==",
        frame.size(),
        frame.len()
    );
    for v in frame.slots() {
        let ty = v
            .ty()
            .map_or_else(|| "-".to_owned(), |id| one_line(frame.types(), id));
        let label = match v.kind() {
            StackSlotKind::Variable { name, .. } if !name.is_empty() => name.clone(),
            StackSlotKind::Variable { .. } => "<unnamed>".to_owned(),
            StackSlotKind::ReturnAddress => "<return address>".to_owned(),
            StackSlotKind::SavedRegisters => "<saved registers>".to_owned(),
        };
        println!("  {:>8}  {label}", soff(v.offset()));
        if ty != "-" {
            println!("            {ty}");
        }
    }
}

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut argv = std::env::args().skip(1);
    let db = argv.next().expect("usage: types <db.i64> [TypeName]");
    let arg_type = argv.next();

    Ida::run(move |ida| -> Result<(), Error> {
        ida.call(move |idb| -> Result<(), Error> {
            idb.open(&db).call()?;

            // Prototypes are sparse in a stripped release binary, so scan every function, not a
            // prefix, so the reported ratio is honest and the sample isn't just entry-point stubs.
            let mut total = 0usize;
            let mut typed = 0usize;
            let mut shown: Vec<(Address, String, Type)> = Vec::new();
            let mut names: Vec<String> = Vec::new();
            let mut best_frame: Option<(Address, StackFrame)> = None;
            let mut best_vars = 0usize;
            let mut frames_tried = 0usize;

            for f in idb.functions() {
                total += 1;

                if let Some(image) = f.prototype_type()? {
                    typed += 1;
                    for (_, t) in image.types().iter() {
                        if let Some(n) = referenced_name(&t.shape)
                            && names.len() < MAX_NAMES
                            && !names.iter().any(|x| x == n)
                        {
                            names.push(n.to_owned());
                        }
                    }
                    if shown.len() < SHOW_PROTOS {
                        shown.push((f.address(), f.name().as_str().to_owned(), image));
                    }
                }

                if frames_tried < FRAME_BUDGET
                    && let Some(frame) = idb.frame(f.address())?
                {
                    frames_tried += 1;
                    // A local lives within its frame; an offset in the millions is IDA's own
                    // misanalysis of a garbage function. Skip such frames so we showcase a real one.
                    let locals = frame.slots().iter().filter(|v| !v.is_special());
                    let sane = locals.clone().all(|v| v.offset().unsigned_abs() < 0x1_0000);
                    let n = locals.count();
                    if sane && (best_frame.is_none() || n > best_vars) {
                        best_vars = n;
                        best_frame = Some((f.address(), frame));
                    }
                }
            }

            println!("== function prototypes ==");
            println!("{typed} of {total} functions carry a stored prototype.\n");
            for (ea, sym, image) in &shown {
                println!("  {ea:#x}  {}", one_line(image.types(), image.root()));
                let short: String = sym.chars().take(64).collect();
                if !short.is_empty() {
                    println!("               {short}");
                }
            }
            if let Some((ea, _, image)) = shown.iter().max_by_key(|(_, _, im)| param_count(im))
                && let TypeShape::Function {
                    ret,
                    params,
                    varargs,
                } = image.shape()
                && !params.is_empty()
            {
                println!("\n  every parameter is a resolved TypeId -- {ea:#x}:");
                println!("    ret    {}", one_line(image.types(), *ret));
                for (i, p) in params.iter().enumerate() {
                    println!("    arg{i}   {}", one_line(image.types(), *p));
                }
                if *varargs {
                    println!("    ...");
                }
            }

            // The named-type pass: resolve every name the prototypes reference and classify what
            // the database actually holds, a full body to expand, or just a forward declaration.
            println!("\n== referenced named types ==");
            if let Some(name) = &arg_type {
                match idb.type_named(name) {
                    Ok(image) => print_layout(&image, name),
                    Err(e) => println!("  type_named({name:?}): {e}"),
                }
            } else {
                let mut bodies: Vec<(String, Type)> = Vec::new();
                let mut forward: Vec<String> = Vec::new();
                let mut not_local = 0usize;
                for name in &names {
                    match idb.type_named(name) {
                        Ok(image) if image.members().is_some_and(|m| !m.is_empty()) => {
                            bodies.push((name.clone(), image));
                        }
                        Ok(_) => forward.push(name.clone()),
                        Err(Error::TypeNotFound { .. }) => not_local += 1,
                        Err(e) => println!("  type_named({name:?}): {e}"),
                    }
                }
                println!(
                    "{} referenced: {} with a full body, {} forward-declared, {} not a local type.",
                    names.len(),
                    bodies.len(),
                    forward.len(),
                    not_local
                );
                if let Some((name, image)) = bodies
                    .iter()
                    .max_by_key(|(_, im)| im.members().map_or(0, <[_]>::len))
                {
                    print_layout(image, name);
                } else {
                    for n in forward.iter().take(6) {
                        println!("  forward-decl: {n}");
                    }
                }
            }

            match &best_frame {
                Some((ea, frame)) => print_frame(frame, *ea),
                None => println!("\n(no function has a stack frame)"),
            }

            idb.close(false);
            println!("\nTYPES OK");
            Ok(())
        })?
    })??;

    Ok(())
}

pub const fn size(&self) -> u64

The slot’s size in bytes.

pub const fn kind(&self) -> &StackSlotKind

What this slot is: a real variable (with name/type) or a reserved slot.

Examples found in repository

examples/types.rs (line 140)

fn print_frame(frame: &StackFrame, ea: Address) {
    println!(
        "\n== stack frame: {ea:#x}  ({} bytes, {} slots) ==",
        frame.size(),
        frame.len()
    );
    for v in frame.slots() {
        let ty = v
            .ty()
            .map_or_else(|| "-".to_owned(), |id| one_line(frame.types(), id));
        let label = match v.kind() {
            StackSlotKind::Variable { name, .. } if !name.is_empty() => name.clone(),
            StackSlotKind::Variable { .. } => "<unnamed>".to_owned(),
            StackSlotKind::ReturnAddress => "<return address>".to_owned(),
            StackSlotKind::SavedRegisters => "<saved registers>".to_owned(),
        };
        println!("  {:>8}  {label}", soff(v.offset()));
        if ty != "-" {
            println!("            {ty}");
        }
    }
}

pub fn name(&self) -> Option<&str>

The variable’s name, or None for a reserved slot.

Shortcut into kind.

pub fn ty(&self) -> Option<TypeId>

The variable’s structured type handle, or None for a reserved slot or an untyped stack slot.

Resolve it against the owning StackFrame with StackFrame::type_of. Shortcut into kind.

Examples found in repository

examples/types.rs (line 138)

fn print_frame(frame: &StackFrame, ea: Address) {
    println!(
        "\n== stack frame: {ea:#x}  ({} bytes, {} slots) ==",
        frame.size(),
        frame.len()
    );
    for v in frame.slots() {
        let ty = v
            .ty()
            .map_or_else(|| "-".to_owned(), |id| one_line(frame.types(), id));
        let label = match v.kind() {
            StackSlotKind::Variable { name, .. } if !name.is_empty() => name.clone(),
            StackSlotKind::Variable { .. } => "<unnamed>".to_owned(),
            StackSlotKind::ReturnAddress => "<return address>".to_owned(),
            StackSlotKind::SavedRegisters => "<saved registers>".to_owned(),
        };
        println!("  {:>8}  {label}", soff(v.offset()));
        if ty != "-" {
            println!("            {ty}");
        }
    }
}

pub const fn is_special(&self) -> bool

Whether this is one of IDA’s reserved slots (return address or saved registers) rather than a real variable.

Examples found in repository

examples/types.rs (line 196)

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let mut argv = std::env::args().skip(1);
    let db = argv.next().expect("usage: types <db.i64> [TypeName]");
    let arg_type = argv.next();

    Ida::run(move |ida| -> Result<(), Error> {
        ida.call(move |idb| -> Result<(), Error> {
            idb.open(&db).call()?;

            // Prototypes are sparse in a stripped release binary, so scan every function, not a
            // prefix, so the reported ratio is honest and the sample isn't just entry-point stubs.
            let mut total = 0usize;
            let mut typed = 0usize;
            let mut shown: Vec<(Address, String, Type)> = Vec::new();
            let mut names: Vec<String> = Vec::new();
            let mut best_frame: Option<(Address, StackFrame)> = None;
            let mut best_vars = 0usize;
            let mut frames_tried = 0usize;

            for f in idb.functions() {
                total += 1;

                if let Some(image) = f.prototype_type()? {
                    typed += 1;
                    for (_, t) in image.types().iter() {
                        if let Some(n) = referenced_name(&t.shape)
                            && names.len() < MAX_NAMES
                            && !names.iter().any(|x| x == n)
                        {
                            names.push(n.to_owned());
                        }
                    }
                    if shown.len() < SHOW_PROTOS {
                        shown.push((f.address(), f.name().as_str().to_owned(), image));
                    }
                }

                if frames_tried < FRAME_BUDGET
                    && let Some(frame) = idb.frame(f.address())?
                {
                    frames_tried += 1;
                    // A local lives within its frame; an offset in the millions is IDA's own
                    // misanalysis of a garbage function. Skip such frames so we showcase a real one.
                    let locals = frame.slots().iter().filter(|v| !v.is_special());
                    let sane = locals.clone().all(|v| v.offset().unsigned_abs() < 0x1_0000);
                    let n = locals.count();
                    if sane && (best_frame.is_none() || n > best_vars) {
                        best_vars = n;
                        best_frame = Some((f.address(), frame));
                    }
                }
            }

            println!("== function prototypes ==");
            println!("{typed} of {total} functions carry a stored prototype.\n");
            for (ea, sym, image) in &shown {
                println!("  {ea:#x}  {}", one_line(image.types(), image.root()));
                let short: String = sym.chars().take(64).collect();
                if !short.is_empty() {
                    println!("               {short}");
                }
            }
            if let Some((ea, _, image)) = shown.iter().max_by_key(|(_, _, im)| param_count(im))
                && let TypeShape::Function {
                    ret,
                    params,
                    varargs,
                } = image.shape()
                && !params.is_empty()
            {
                println!("\n  every parameter is a resolved TypeId -- {ea:#x}:");
                println!("    ret    {}", one_line(image.types(), *ret));
                for (i, p) in params.iter().enumerate() {
                    println!("    arg{i}   {}", one_line(image.types(), *p));
                }
                if *varargs {
                    println!("    ...");
                }
            }

            // The named-type pass: resolve every name the prototypes reference and classify what
            // the database actually holds, a full body to expand, or just a forward declaration.
            println!("\n== referenced named types ==");
            if let Some(name) = &arg_type {
                match idb.type_named(name) {
                    Ok(image) => print_layout(&image, name),
                    Err(e) => println!("  type_named({name:?}): {e}"),
                }
            } else {
                let mut bodies: Vec<(String, Type)> = Vec::new();
                let mut forward: Vec<String> = Vec::new();
                let mut not_local = 0usize;
                for name in &names {
                    match idb.type_named(name) {
                        Ok(image) if image.members().is_some_and(|m| !m.is_empty()) => {
                            bodies.push((name.clone(), image));
                        }
                        Ok(_) => forward.push(name.clone()),
                        Err(Error::TypeNotFound { .. }) => not_local += 1,
                        Err(e) => println!("  type_named({name:?}): {e}"),
                    }
                }
                println!(
                    "{} referenced: {} with a full body, {} forward-declared, {} not a local type.",
                    names.len(),
                    bodies.len(),
                    forward.len(),
                    not_local
                );
                if let Some((name, image)) = bodies
                    .iter()
                    .max_by_key(|(_, im)| im.members().map_or(0, <[_]>::len))
                {
                    print_layout(image, name);
                } else {
                    for n in forward.iter().take(6) {
                        println!("  forward-decl: {n}");
                    }
                }
            }

            match &best_frame {
                Some((ea, frame)) => print_frame(frame, *ea),
                None => println!("\n(no function has a stack frame)"),
            }

            idb.close(false);
            println!("\nTYPES OK");
            Ok(())
        })?
    })??;

    Ok(())
}

Trait Implementations

impl Clone for StackSlot

fn clone(&self) -> StackSlot

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for StackSlot

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for StackSlot

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for StackSlot

impl Hash for StackSlot

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for StackSlot

fn eq(&self, other: &StackSlot) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for StackSlot

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for StackSlot