1

I have 2 armv7-m (Thumb) branch instructions (in Hex) which call one function. Can you tell me how can I caculate the offset of this function, so that I can call it at other position.

Thanks!

Offset 0020922A - Hex: 07 F6 6C FE

Offset 0020941A - Hex: 07 F6 74 FD

I have figured out how to caculate it:

  • So we have 07 F6 6C FE(arm - little endian) -> F6 07 | FE 6C
  • F6 07 | FE 6C = 1111 0110 0000 0111 | 1111 1110 0110 1100
  • Look at 5.19 (ece.uwaterloo.ca/~ece222/ARM/ARM7-TDMI-manual-pt3.pdf) we will find how to get opcode:
    • The first half F6 07 = 1111 0110 0000 0111 = F000 + 607
    • The second half FE 6C = 1111 1110 0110 1100 = F800 + 66C
    • 66C << 1 = 110011011000 = CD8 => offset = 607CD8
  • Is it correct? So we test it in: Offset 0020941A - Hex: 07 F6 74 FD
  • we have offset in this case is: 607CD8 - (0020941A - 0020922A) = 607AE8
  • new branch instruction = F000 + 607 | F800 + (AE8 >> 1)
  • AE8 = 101011101000 -> 10101110100 = 574 => F6 07 FD 74 :D/
  • try to explain a little better what exactly you need – Igor Skochinsky Jul 22 '18 at 17:30
  • For example: I want to call this function at address 0x00209548, so what is our opcode ? – HaiLe Jul 23 '18 at 20:06
  • update the question and add the answer, Ill reopen it – Igor Skochinsky Jul 23 '18 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.