When reversing a ARM firmware using IDA Pro, I find a instruction:

ROM:080461FC 0F F2 24 30 ADR.W R0, aBt_test_mode ; "BT_TEST_MODE"


ROM:08046524 aBt_test_mode DCB "BT_TEST_MODE",0


I know this is a Thumb-2 instruction. enter image description here imm8=0010 0100



but I don't know how to calculate imm32. (imm32 = ZeroExtend(i:imm3:imm8, 32)) and how to calculate the 08046524?


As you say, you have -

imm8 = 0010 0100

imm3 = 011

but you also have

i = 0


imm32 = ZeroExtend(i:imm3:imm8,32) =>

imm32 = ZeroExtend(0:011:00100100,32) =>

imm32 = ZeroExtend(001100100100,32) =>

imm32 = 00000000000000000000001100100100 = 0x00000324

The ADR instruction description explains that "This instruction adds an immediate value to the PC value to form a PC-relative address, and writes the result to the destination register."

As you are in Thumb mode, the value of PC is equal to the (4 byte aligned) address of the instruction + 4 bytes. In your case the instruction is at address 0x080461FC so PC = 0x080461FC + 4 = 0x08046200

The address calculation is then -

PC + imm32 = 0x08046200 + 0x00000324 = 0x08046524

This is what you see in IDA's disassembly.

If you look in the 'Operation' section of the ADR instruction in the ARM architecture reference manual you can see this explained.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.