When reversing a ARM firmware using IDA Pro, I find a instruction:
ROM:080461FC 0F F2 24 30 ADR.W R0, aBt_test_mode ; "BT_TEST_MODE"
...
ROM:08046524 aBt_test_mode DCB "BT_TEST_MODE",0
...
I know this is a Thumb-2 instruction.
imm8=0010 0100
Rd=0000
imm3=011
but I don't know how to calculate imm32. (imm32 = ZeroExtend(i:imm3:imm8, 32)) and how to calculate the 08046524?
As you say, you have -
imm8 = 0010 0100
imm3 = 011
but you also have
i = 0
then
imm32 = ZeroExtend(i:imm3:imm8,32) =>
imm32 = ZeroExtend(0:011:00100100,32) =>
imm32 = ZeroExtend(001100100100,32) =>
imm32 = 00000000000000000000001100100100 = 0x00000324
The ADR instruction description explains that "This instruction adds an immediate value to the PC value to form a PC-relative address, and writes the result to the destination register."
As you are in Thumb mode, the value of PC is equal to the (4 byte aligned) address of the instruction + 4 bytes.
In your case the instruction is at address 0x080461FC so PC = 0x080461FC + 4 = 0x08046200
The address calculation is then -
PC + imm32 = 0x08046200 + 0x00000324 = 0x08046524
This is what you see in IDA's disassembly.
If you look in the 'Operation' section of the ADR instruction in the ARM architecture reference manual you can see this explained.
