Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I am aware i can decode the instruction, then check the op.dtype. But this doesnt work in cases such as mov eax, dword [rax] because the second operand will be of dtype dword, while the basereg register rax is of course 64bits.
How can I find out that rax is a 64bit register in this case?
insn_t/op_trepresentation. The sizes of the registers used in an x86/x64 memory expression are implicit; they're equal to the size of the operating mode. I.e. in 32-bit (64-bit) mode, registers in a memory expression will always be 32-bits (64-bits). It probably works similarly on most other platforms, though you may need platform-specific logic in some cases.