Search code examples
c++reverse-engineeringida

Getting the Value of a CPP Object using IDA Pro and IDAPython


I've set a breakpoint using IDA Pro on a function that returns a cocos2d::Image object pointer as a response, as can be seen in the screenshot below.

IDA Breakpoint

However, I'm at a complete loss at how I can use IDAPython to print out the Object members, and such. Is there a way to do it? The Docs haven't been too helpful, and only seem to have methods to check for C-like structs.


Solution

  • Use print Dword(addr) for printing dword-sized members and print Byte(addr) for printing byte-sized members. Result is stored in eax, so you can use relative offsets from eax to get member addresses. To print all the members from the screenshot that will be:

    eaxVal = GetRegValue("eax")
    print Dword(eaxVal+45)
    print "\n"
    print Dword(eaxVal+51)
    print "\n"
    print Dword(eaxVal+52)
    print "\n"
    print Byte(eaxVal+184)
    print "\n"
    print Byte(eaxVal+188)
    print "\n"