I'm writing an IDA plugin using idapython in order to add comments (located in database) to variables of struct types. In order to do this, firstly, i need to get the list of cross-references to a given structure type (e.g. struct BITMAPINFO) which can be found in Structure subview in IDA. I know IDA provides this function from version 6.2 by right-button mouse clicking on the structure name and selecting List cross references to. A window like the following will be popped-up:Each item of the list in above picture is either an address where a global variable of type %structure name% (here is BITMAPINFO) is declared or a position where a local variable of type structure name is defined. The former is like(here is type GUID, not BITMAPINFO).The latter is likeThis is the position where IDA declare local variables based on its identified type.I wonder if there is a way to get these data by IDAPython.NOTE: This is different from cross-references to a(ll) member(s) of a struct type, which can be got by right-button mouse clicking on the structure member name, shown as the followingBefore asking here, i do it like:#CODE 1ea = idc.LocByName(%structure name%)  frm = [x.frm for x in idautils.XrefsTo(ea)]I think i have got the whole list of cross-references to %structure name% using my above code. However, i found many EAs in the list seem like ineffective such as '0xff0052c9' (MaxEA is 0x108f800). However, i guess my code has got the desired result because the length of returned list is equal to the number of items in the list shown as the 1st picture. But i can't explain the result especially the (seemingly) ineffective ones. Also, when i add comments to the addresses in the list using the following code#CODE 2for ea in xrefs_list:    # each cross-reference to the given struc type    if repeatable:        # add repeatable comment 'cmt' at address 'ea'        idc.MakeRptCmt(ea, cmt)    else:        # add comment  'cmt' at address 'ea'        idc.MakeComm(ea, cmt)i found i only added comments to the effective addresses which are between idc.MinEA() and idc.MaxEA(), and these addresses are places where global instances of the queried struct type are declared, as shown in the 2nd picture.My questions are:Is my above code (CODE 1) correct to get all cross-references to a struct type?  If it is, how to explain those seemingly ineffective addresses (above 0xFF000000)How to add comments to other cross-reference addresses other than the references to global instances of the struct type? 
How to get cross-references to a struct type in IDA by IDAPython and add comments to variables of the struct type
ida;idapython
Stack Variable ReferencesThe xrefs you are showing are xrefs from stack variables. As you mentioned, when trying to get the xrefs to the struct, you get two types of results:Valid addresses, which are struct instances in the data section0xFF000000 and above addresses, where the struct is used as a stack variable.In IDA the stack variables for a function are represented internally as a struct, with each stack variable a member of that struct.idaman struc_t *ida_export get_frame(const func_t *pfn);Docs linkKnowing that, we can infer that the weird xrefs are member-ids (which they are). To get the names of the containing structs we use fullname = idaapi.get_member_fullname(mid) and get something like $ F4014B0.var_14.$ F4014B0 is the netnode name of the stack-frame struct for the function at 0xF4014B0.import idcimport idaapiimport idautilssid = idc.GetStrucIdByName('my-struct-name')for xref in idautils.XrefsTo(sid):    if 0xFF000000 > xref.frm:        # The struct is used as data        print 'Data xref from 0x{:X}'.format(xref.frm)    else:        # The struct is used as a stack variable.        mid = xref.frm        fullname = idaapi.get_member_fullname(mid)        function_ea = int(fullname[2:].split('.')[0], 0x10)        print 'Stack xref from 0x{:X}'.format(function_ea)Getting Xrefs to member Variables(This is here because it was my initial answer, and it contains valuable information.)You were really close to the solution. Your code gives you the sid, so you only get references to the struct itself. What you need, is references to the different members, and this can be done using the mid. You can get it using fully-qualified member names. However, since there are many members to every struct, enumerating them is usually a better choice.import idcimport idautilsdef get_member_ids(sid):    offset = 0    while offset != 0xFFFFFFFF:        mid = idc.GetMemberId(sid, offset)        if mid != -1:            yield mid        offset = idc.GetStrucNextOff(sid, offset)def get_member_xrefs(struc_name):    sid = idc.GetStrucIdByName(struc_name)    for mid in get_member_ids(sid):        for xref in idautils.XrefsTo(mid):            yield xref.frm# And the usage:for xref in get_member_xrefs('my-struct-name'):    print '0x{:X}'.format(xref)edit to answer question in commentA Bit on NetnodesThis next bit is about IDA internals, so I might be off mark here. I am basic the information on SDK docs see hereAs visible in my code, many APIs that are documented for use on effective addresses (eas) also work on other IDA primitives - struct ids, member ids - without any difference.Internally, objects in IDA are mapped to netnodes. Lines in IDA are mapped linearly to netnode numbers, While other objects are mapped to numbers starting at 0xFF000000. While addresses and struct ids might have a different semantic meaning, they are both netnode numbers. In IDA's APIs, this means that they are treated the same way.I hope this makes things clearer.