how to understand branch arm instruction

Question

I have this instruction F6F700B8 I know that it b #-0xA000 but how I can understand from F6F700B8 that is b #-0xA000 ? .

When I tried to translate it on http://armconverter.com/hextoarm/ I get B.W #0xFFFF6004 how 0xFFFF6004 came to -0xA000 ?

thank

Answer 1

answer is for point 2 of your question regarding the conversion by hextoarm

it is pc relative

you did not give a starting offset so it is assumed as 0x0

the pc will be 4 bytes ahead

so PC would be 0x4

therefore offset would be (4 - 0xa000) == 0xffff6004

0xffff6004 is == - (minus) 0x9ffc read about 2's complement

C:\>e:\GNUWIN32\bin\calc.exe
C-style arbitrary precision calculator (version 2.11.10.1)
Calc is open software. For license details type:  help copyright
[Type "exit" to exit, or "help" for help.]

; base(16)
        0xa
; -0x9ffc
        -0x9ffc
; 0xffff6004 - 0x100000000
        -0x9ffc
;

if your current address were 0x9ffc your PC would be 0xa000 and the disassembly would have been b.w #0

but since you didn't give a start address hextoarm subtracted 0x9ffc from 0 and provided you a negative offset 0xffff6004 which is 2s complement of 0x9ffc

C:>python -c "print \"%x\" % (0x100000000 - 0xffff6004 +4 )" a000

before you ask what 2,s complement is here is a simple python script that shows what 2's complement is

print("2's complement Notation is")
print("take the input number and flip all bits and add 1 to the result")
print("xorring with 0xffffffff flips all the 32 bits in a given number")
import sys
arm_opcode = input("provide a number : " )
print ( "you entered " +  hex(arm_opcode))
print ("flipping the bits and adding 1 to " + hex(arm_opcode) )
twoscomp =  hex(int( arm_opcode ^ 0xffffffff ) + 1)
print ("2's complement for " + hex(arm_opcode) + " is " + twoscomp )

executing it

C:>python twoscompdemo.py

2's complement Notation is
take the input number and flip all bits and add 1 to the result
xorring with 0xffffffff flips all the 32 bits in a given number
provide a number : 0xffff6004
you entered 0xffff6004L
flipping the bits and adding 1 to 0xffff6004L
2's complement for 0xffff6004L is 0x9ffc

==========================================================================

for your f6f700b8 you should state what your current address is if it is as you say b #-0xa000 then address happens to be -0x4 which appears illogical

C:\>python
>>> from keystone import *
>>> for i in (Ks(KS_ARCH_ARM,KS_MODE_THUMB).asm("b.w #-0xa000" , -0x4 ))[0]:
...     print "%02x " % i,
...
f6  f7  00  b8
>>>