Proper way to get the length of operand

[taoyu028]

I am trying to get the length of operands in compare instructions. I have tried to use

register = instr.getRegister(0)
print(register.getBitLength())

However, for the case (X86-64) like

CMP  dword ptr [RSP + local_9c],0x2

outputs 64 instead of the expected value 32

I couldn't find the proper function to use to get the length of an operand. Maybe someone here can help? Thanks!

[taoyu028]

Does anyone know which function should I use to check whether an operand is a byte pointer or word pointer or qword ptr?

[ReversingWithMe]

This is a bit weird, but letting the type system cast the immediates in this case to the size of the pointer in operand 0.

The other option is pulling out the value you want from pcode.

# Get the instruction at the current address
instr = getInstructionAt(currentAddress)
if instr is None:
    print("No instruction at %s" % currentAddress)
    exit()

print("0x%s:\t%s" % (currentAddress, instr))

# Iterate over each operand
for opIndex in range(instr.getNumOperands()):
    print("\nOperand %d:" % opIndex)
    # What kind of operand is it?
    opType = instr.getOperandType(opIndex)
    print("  OperandType bits: 0x%X" % opType)

    # The raw objects making up this operand (Registers, Scalars, Addresses, etc.) :contentReference[oaicite:0]{index=0}
    opObjs = instr.getOpObjects(opIndex)
    if not opObjs:
        print("   (no objects)")
    for obj in opObjs:
        # Scalar literal (immediate)
        if isinstance(obj, Scalar):
            # getScalar returns a Scalar for this operand index :contentReference[oaicite:1]{index=1}
            scalar = instr.getScalar(opIndex)
            # Scalar stores its bit-length
            bitLen = scalar.bitLength()      # length in bits
            byteLen = bitLen // 8
            print("   Scalar: value=0x%s, bits=%d  %d bytes" %
                  (scalar.getUnsignedValue(), bitLen, byteLen))
        # Register operand
        elif isinstance(obj, Register):
            reg = instr.getRegister(opIndex)
            bitLen = reg.getBitLength()
            print("   Register: %s, bits=%d  %d bytes" %
                  (reg.getName(), bitLen, bitLen // 8))
        # Memory reference (e.g. [rax+4])
        else:
            # Try to find any MemoryReference on this operand
            refs = instr.getOperandReferences(opIndex)  # returns Reference[] :contentReference[oaicite:2]{index=2}
            if refs:
                for ref in refs:
                    memRef = ref.memoryReference
                    # print(dir(ref.getToAddress()))
                    # print(ref.getToAddress().getPointerSize())
                    try:
                        length = ref.getLength()
                        print("   MemoryReference: %s  %d bytes" %
                            (ref, length))
                    except:
                        print("   Reference: %s (no length available)" % ref)
            else:
                # Just dump whatever else is in the operand
                print("   Object:", obj)

For your specific case, this fails due to reg and scalar both not having defined bitsize functions.

Looking at the Pcode does provide the answer though, but only accounts for load, store, and fails on the first two above due to COPY being used.

instr = getInstructionAt(currentAddress)
    if instr is None:
        print("No instruction at %s" % currentAddress)
        exit()

    print("0x%s:\t%s" % (currentAddress, instr))

    # Analyze P-code for memory access sizes
    pcodeOps = instr.getPcode()

    if not pcodeOps:
        print("No PcodeOps available for instruction.")
        exit()

    for pcode in pcodeOps:
        mnemonic = pcode.getMnemonic()
        print("\nPcodeOp: %s" % mnemonic)

        if mnemonic in ("LOAD", "STORE"):
            if mnemonic == "LOAD":
                # LOAD: output is the result of the load, input[1] is address, input[0] is space (usually RAM)
                output = pcode.getOutput()
            else:  # STORE
                # STORE: input[2] is value being stored, input[1] is address
                output = pcode.getInput(2)

            size = output.getSize() if output else -1
            addrVarnode = pcode.getInput(1)

            print("  Memory Access:")
            print("    Size: %d bytes" % size)
            if addrVarnode.isAddress():
                addr = addrVarnode.getAddress()
                print("    Address: %s" % addr)
            else:
                print("    Address (non-constant or computed):", addrVarnode)

        else:
            # Other PcodeOps can be analyzed similarly if needed
            pass

[ReversingWithMe]

Simplified with only Pcode extraction, for Store, Load, and Copy

#@category MyScripts
from ghidra.program.model.listing import Instruction
from ghidra.program.model.lang import OperandType
from ghidra.program.model.scalar import Scalar
from ghidra.program.model.lang import Register
from ghidra.program.model.listing import CodeUnit
from ghidra.program.model.pcode import PcodeOp
from ghidra.util.task import ConsoleTaskMonitor


# Get the instruction at the current address
instr = getInstructionAt(currentAddress)
if instr is None:
    print("No instruction at %s" % currentAddress)
    exit()

print("0x%s:\t%s" % (currentAddress, instr))


# Analyze P-code for memory access sizes
pcodeOps = instr.getPcode()

if not pcodeOps:
    print("No PcodeOps available for instruction.")
    exit()

found = False
for pcode in pcodeOps:
    mnemonic = pcode.getMnemonic()
    # print("\nPcodeOp: %s" % mnemonic)

    if mnemonic in ("LOAD", "STORE", "COPY"):
        if mnemonic == "LOAD":
            # LOAD: output is the result of the load, input[1] is address, input[0] is space (usually RAM)
            output = pcode.getOutput()
        elif mnemonic == "STORE":
            # STORE: input[2] is value being stored, input[1] is address
            output = pcode.getInput(2)
        elif mnemonic == "COPY":
            # LOAD: output is the result of the load, input[1] is address, input[0] is space (usually RAM)
            output = pcode.getOutput()
        else:
            print("???")
            continue

        size = output.getSize() if output else -1

        print("  Memory Access:")
        print("    Size: %d bytes with %s" % (size, mnemonic))
        found = True
        break
    else:
        # Other PcodeOps can be analyzed similarly if needed
        pass
if found is False:
    for pcode in pcodeOps:
        mnemonic = pcode.getMnemonic()
        print("\nPcodeOp: %s" % mnemonic)