So here is a byte sequence
45 A6 F7 in the
It points to a subroutine which is located at
IDA expresses it as "function_symbol +1"
Why does it plus one?
Why is it
45 A6 F7 rather than
44 A6 F7?
If it is ARM architecture that may use THUMB encoding it can be result of the following issue:
If I remember correctly, calls to the virtual functions can be executed with assembly command similar to
BLX as indirect jump, which allows switching between ARM and THUMB encoding. In this case this
+ 1 means that the target of the jump is encoded in THUMB.
See here for more information about this mechanism.
All these instructions cause a branch to label, or to the address contained in Rm. In addition:
- The BL and BLX instructions copy the address of the next instruction into lr (r14, the link register).
- The BX and BLX instructions can change the processor state from ARM to Thumb, or from Thumb to ARM. BLX label always changes the state. BX Rm and BLX Rm derive the target state from bit of Rm:
- if bit of Rm is 0, the processor changes to, or remains in, ARM state
- if bit of Rm is 1, the processor changes to, or remains in, Thumb state.