# how to understand branch arm instruction

I have this instruction `F6F700B8` I know that it `b #-0xA000` but how I can understand from `F6F700B8` that is `b #-0xA000` ? .

When I tried to translate it on http://armconverter.com/hextoarm/ I get `B.W #0xFFFF6004` how `0xFFFF6004` came to `-0xA000` ?

thank

answer is for point 2 of your question regarding the conversion by hextoarm

it is pc relative

you did not give a starting offset so it is assumed as 0x0

the pc will be 4 bytes ahead

so PC would be 0x4

therefore offset would be (4 - 0xa000) == 0xffff6004

``````C:\>e:\GNUWIN32\bin\calc.exe
C-style arbitrary precision calculator (version 2.11.10.1)
[Type "exit" to exit, or "help" for help.]

; base(16)
0xa
; -0x9ffc
-0x9ffc
; 0xffff6004 - 0x100000000
-0x9ffc
;
``````

if your current address were 0x9ffc your PC would be 0xa000 and the disassembly would have been b.w #0

but since you didn't give a start address hextoarm subtracted 0x9ffc from 0 and provided you a negative offset 0xffff6004 which is 2s complement of 0x9ffc

C:>python -c "print \"%x\" % (0x100000000 - 0xffff6004 +4 )" a000

before you ask what 2,s complement is here is a simple python script that shows what 2's complement is

``````print("2's complement Notation is")
print("take the input number and flip all bits and add 1 to the result")
print("xorring with 0xffffffff flips all the 32 bits in a given number")
import sys
arm_opcode = input("provide a number : " )
print ( "you entered " +  hex(arm_opcode))
print ("flipping the bits and adding 1 to " + hex(arm_opcode) )
twoscomp =  hex(int( arm_opcode ^ 0xffffffff ) + 1)
print ("2's complement for " + hex(arm_opcode) + " is " + twoscomp )
``````

executing it

C:>python twoscompdemo.py

``````2's complement Notation is
take the input number and flip all bits and add 1 to the result
xorring with 0xffffffff flips all the 32 bits in a given number
provide a number : 0xffff6004
you entered 0xffff6004L
flipping the bits and adding 1 to 0xffff6004L
2's complement for 0xffff6004L is 0x9ffc
``````

==========================================================================

for your f6f700b8 you should state what your current address is if it is as you say b #-0xa000 then address happens to be -0x4 which appears illogical

``````C:\>python
>>> from keystone import *
>>> for i in (Ks(KS_ARCH_ARM,KS_MODE_THUMB).asm("b.w #-0xa000" , -0x4 ))[0]:
...     print "%02x " % i,
...
f6  f7  00  b8
>>>
``````
• if I only have `0xffff6004` how do I come to `0xa000` please? May 8 '18 at 20:32
• you should read a lot this is a simple 2 s complement notation you are asking the wrong questions if you are trying to reverse something you should know this by heart and should be able to recognize 2s complements just by seeing them any way i have added details to my answer May 9 '18 at 9:25