I have this instruction F6F700B8 I know that it b #-0xA000 but how I can understand from F6F700B8 that is b #-0xA000 ? .

When I tried to translate it on http://armconverter.com/hextoarm/ I get B.W #0xFFFF6004 how 0xFFFF6004 came to -0xA000 ?


1 Answer 1


answer is for point 2 of your question regarding the conversion by hextoarm

it is pc relative

you did not give a starting offset so it is assumed as 0x0

the pc will be 4 bytes ahead

so PC would be 0x4

therefore offset would be (4 - 0xa000) == 0xffff6004

0xffff6004 is == - (minus) 0x9ffc read about 2's complement

C-style arbitrary precision calculator (version
Calc is open software. For license details type:  help copyright
[Type "exit" to exit, or "help" for help.]

; base(16)
; -0x9ffc
; 0xffff6004 - 0x100000000

if your current address were 0x9ffc your PC would be 0xa000 and the disassembly would have been b.w #0

but since you didn't give a start address hextoarm subtracted 0x9ffc from 0 and provided you a negative offset 0xffff6004 which is 2s complement of 0x9ffc

C:>python -c "print \"%x\" % (0x100000000 - 0xffff6004 +4 )" a000

before you ask what 2,s complement is here is a simple python script that shows what 2's complement is

print("2's complement Notation is")
print("take the input number and flip all bits and add 1 to the result")
print("xorring with 0xffffffff flips all the 32 bits in a given number")
import sys
arm_opcode = input("provide a number : " )
print ( "you entered " +  hex(arm_opcode))
print ("flipping the bits and adding 1 to " + hex(arm_opcode) )
twoscomp =  hex(int( arm_opcode ^ 0xffffffff ) + 1)
print ("2's complement for " + hex(arm_opcode) + " is " + twoscomp )

executing it

C:>python twoscompdemo.py

2's complement Notation is
take the input number and flip all bits and add 1 to the result
xorring with 0xffffffff flips all the 32 bits in a given number
provide a number : 0xffff6004
you entered 0xffff6004L
flipping the bits and adding 1 to 0xffff6004L
2's complement for 0xffff6004L is 0x9ffc


for your f6f700b8 you should state what your current address is if it is as you say b #-0xa000 then address happens to be -0x4 which appears illogical

>>> from keystone import *
>>> for i in (Ks(KS_ARCH_ARM,KS_MODE_THUMB).asm("b.w #-0xa000" , -0x4 ))[0]:
...     print "%02x " % i,
f6  f7  00  b8
  • if I only have 0xffff6004 how do I come to 0xa000 please?
    – ARMisKing
    May 8, 2018 at 20:32
  • you should read a lot this is a simple 2 s complement notation you are asking the wrong questions if you are trying to reverse something you should know this by heart and should be able to recognize 2s complements just by seeing them any way i have added details to my answer
    – blabb
    May 9, 2018 at 9:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.