# Trace back Offset Function

I have 2 armv7-m (Thumb) branch instructions (in Hex) which call one function. Can you tell me how can I caculate the offset of this function, so that I can call it at other position.

Thanks!

Offset 0020922A - Hex: 07 F6 6C FE

Offset 0020941A - Hex: 07 F6 74 FD

I have figured out how to caculate it:

• So we have 07 F6 6C FE(arm - little endian) -> F6 07 | FE 6C
• F6 07 | FE 6C = 1111 0110 0000 0111 | 1111 1110 0110 1100
• Look at 5.19 (ece.uwaterloo.ca/~ece222/ARM/ARM7-TDMI-manual-pt3.pdf) we will find how to get opcode:
• The first half F6 07 = 1111 0110 0000 0111 = F000 + 607
• The second half FE 6C = 1111 1110 0110 1100 = F800 + 66C
• 66C << 1 = 110011011000 = CD8 => offset = 607CD8
• Is it correct? So we test it in: Offset 0020941A - Hex: 07 F6 74 FD
• we have offset in this case is: 607CD8 - (0020941A - 0020922A) = 607AE8
• new branch instruction = F000 + 607 | F800 + (AE8 >> 1)
• AE8 = 101011101000 -> 10101110100 = 574 => F6 07 FD 74 :D/
• try to explain a little better what exactly you need – Igor Skochinsky Jul 22 '18 at 17:30
• For example: I want to call this function at address 0x00209548, so what is our opcode ? – HaiLe Jul 23 '18 at 20:06
• update the question and add the answer, Ill reopen it – Igor Skochinsky Jul 23 '18 at 20:14