I am reversing ARM Thumb2 code.

I am looking for a table that shows which registers are used to pass arguments to functions, and which registers must be saved after the function ends.

By the way, if I see push r5-r9 at the beginning of the function and pop r5-r9 at the end of function, are those registers saved?


2 Answers 2


This is all documented in the ARM Architecture Procedure Call Standard (AAPCS) ARM IHI0042. There may be more recent versions. The short version: R0-R3 are for passing arguments, R12 is a scratch register for procedure calls (linker things, etc) and everything else must be preserved by functions that use it.

  • 2
    Do you have a link to the Arm Procedure Call Standard (AAPCS) Arm IHI 0042F doc? I would like to take a look at it
    – julian
    Nov 10, 2018 at 3:30

Typically, the push r5-r9 instruction is a way to save the content of these registers (ie r5, r6, r7, r8, r9) on the stack, then the pop r5-r9 is restoring the saved values before leaving the function stack-frame.

This is quite common behavior when you want to manipulate non-volatile registers within your stack-frame and be compliant to the ABI. It is extremely frequent to see these way of doing in compiler generated assembly code.

  • So are these typically the registers used to pass arguments to a function (first part of the question!)?
    – 0xC0000022L
    Jun 15, 2018 at 18:54
  • 1
    It depends of the ABI, the question is not precise enough to answer properly. We need to know the OS used (and thus the ABI used).
    – perror
    Jun 15, 2018 at 19:04
  • @perror, I talking about embbeded without os
    – Keystone
    Jun 16, 2018 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.