Stack frame tools: inspect and modify stack variables

Stack frame tools operate on IDA’s function frame — the structured description of a function’s local storage. You can inspect every frame variable with its offset, type, and size; create new variables at specific offsets with explicit types; and delete variables that are no longer needed. These tools complement the rename and type operations available in the Modification and Type tools.

Stack frame variables are IDA frame members, distinct from Hex-Rays local variables (lvars). Renaming a frame member renames it in the disassembly view; renaming an lvar renames it in the decompiler view. Use rename with the stack key for frame members and local for decompiler variables.

stack_frame

Return the list of stack variables for one or more functions.

addrs

string | string[]

required

One or more function addresses or symbol names. Each address is resolved to the function that contains it.

Returns StackFrameResult[]

Show StackFrameResult fields

addr

string

Input address, echoed back.

vars

StackFrameVariable[] | null

List of frame variables, or null on error.

Show StackFrameVariable fields

name

string

Variable name.

offset

string

Frame offset as a hex string (signed, relative to the frame pointer).

size

string

Size in bytes.

type

string

Type string.

error

string

Present only on failure.

"0x401000"

Example response:

[
  {
    "addr": "0x401000",
    "vars": [
      { "name": "var_18", "offset": "-0x18", "size": "8",  "type": "qword" },
      { "name": "var_10", "offset": "-0x10", "size": "8",  "type": "qword" },
      { "name": "var_4",  "offset": "-0x4",  "size": "4",  "type": "dword" }
    ]
  }
]

declare_stack

Create a named, typed stack variable at a specific frame offset inside a function.

items

StackVarDecl | StackVarDecl[]

required

Show StackVarDecl fields

addr

string

required

Address of the containing function (or any address inside it).

offset

string

required

Frame offset for the new variable, as a hex or decimal string. Negative values refer to local storage (e.g., -0x18); positive values to function arguments.

name

string

required

Name for the new variable.

string

required

Type name from the local type library (e.g., "uint32_t", "Config *", "HANDLE").

Returns StackMutationResult[]

Show StackMutationResult fields

addr

string

Function address.

name

string

Variable name.

error

string

Present only on failure.

Declare a typed local variable

{
  "addr": "0x401000",
  "offset": "-0x18",
  "name": "ctx",
  "ty": "Config *"
}

Use declare_type to register a custom struct before referencing it as a ty here. Any type already in IDA’s type library — including standard C types like uint32_t — can be used directly.

delete_stack

Delete a stack frame variable by name. The function’s frame is looked up automatically. Special frame members (such as saved registers and the return address) and argument slots cannot be deleted.

items

StackVarDelete | StackVarDelete[]

required

Show StackVarDelete fields

addr

string

required

Address of the containing function.

name

string

required

Exact name of the frame variable to delete.

Returns StackMutationResult[]

Show StackMutationResult fields

addr

string

Function address.

name

string

Variable name.

error

string

Present only on failure. Common values:

"<name> not found" — variable does not exist.
"<name> is special frame member" — cannot delete saved registers or return address.
"<name> is argument member" — argument slots are not removable.

Delete a stack variable

{
  "addr": "0x401000",
  "name": "var_4"
}

Example workflow

The following sequence inspects a function’s stack frame, renames an auto-generated variable, assigns it a concrete type, then verifies the result.

Inspect the stack frame

stack_frame call

"0x401000"

Response shows var_18 at offset -0x18 with type qword.

Rename the variable

Use rename with the stack key:

rename call

{
  "stack": {
    "func_addr": "0x401000",
    "old": "var_18",
    "new": "p_config"
  }
}

Apply a type

Use set_type with kind: "stack":

set_type call

{
  "addr": "0x401000",
  "name": "p_config",
  "ty": "Config *",
  "kind": "stack"
}

Verify

Call stack_frame again on 0x401000 to confirm p_config now appears with type Config *.

Core & Analysis

Modification

Advanced

Stack frame tools: inspect and modify stack variables

stack_frame

declare_stack

delete_stack

Example workflow

Build docs developers (and LLMs) love

Core & Analysis

Modification

Advanced

Documentation Index

​stack_frame

​declare_stack

​delete_stack

​Example workflow

Build docs developers (and LLMs) love

stack_frame

declare_stack

delete_stack

Example workflow