I've been trying to analyze an ARM binary but cannot figure out how the operators and operands are stored in the bytes of a program.

For example, by looking at the disassembly listing of an ARMv7 binary, I cannot deduce what the opcode for cmp is from these three lines, nor do I understand how it's encoded or how it's operands are encoded:

cmp r5, #0; 0x2d00
cmp r4, #0; 0x2c00
cmp r0, r2; 0x4290

How is the cmp operator, and it's respective operands encoded into two bytes?

  • I've tried comparing the bits using print "{:16b}\n{:16b}\n{:16b}".format(0x2d00,0x2c00,0x4290) in Python, and I can't see a pattern emerging for cmp.
    – edition
    Oct 17 '18 at 7:46

See ARM7 Data Sheet 4.4 Data processing page 23. But there will be the different encoding of the instruction depending on the instruction set (ARM or Thumb). See also this question

  • That clears up the confusion I was having, as I now know how the bits affect the operator.
    – edition
    Oct 17 '18 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.