I've been reversing an asm checksum code for the last days, and I've managed to understand how it completly works, except for one instruction; ldrh

The info I've been able to found says that it's basically a ldr instruction which loads a half word (2 bytes). But the problem is that the ldr() instruction has a lot of variants and there's no info about how this one would be wrote in pseudo C.

Specifically my instruction is:
ldrh r3,[r12,r3]
If it were a normal ldr, the pseudo code will be
r3 = r12[r3];
(r12 is an addres to a memory place so I don't understand what it really does..Does it loads the value at r12+r3 into r3?

  • 1
    r3 = ((unsigned short*)r12)[r3], sorry, previous comment was not correct, i deleted it.
    – w s
    Jun 28, 2016 at 13:34
  • @ws So it is actually getting a 2 bytes value which is at address r12[r3] (r12+r3) right?
    – 78dtat78da
    Jun 28, 2016 at 13:35
  • infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0489c/… - the definition of ldr is still here, I just didn't take in account endianess correctly
    – w s
    Jun 28, 2016 at 13:36
  • 1
    Yes, you are right
    – w s
    Jun 28, 2016 at 13:36

1 Answer 1


As specified by @w s , the C representation of the assembly instruction ldrh r3,[r12,r3] would be:

r3 = ((unsigned short*)r12)[r3]

For more documentation, visit:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.