I disassembled an android library with IDA, and want to do some extra steps at the end of one of the functions. Currently, the last instruction bytes are BD E8 F0 8F, in thumb mode, which IDA disassembles to POP.W {R4-R11,PC}.
So i found a nice little piece of unused space, replaced the POP.W with a branch there, wrote my extension, remembered to put a .thumb and .arch armv7a at the start of my program, and finished my code with that POP.W {R4-R11,PC}. Unfortunately, using gnu as from an arm toolchain, this results in Error: bad instruction pop.w '{R4-R11,PC}'
Ok, gnu as doesn't like the .w suffix, so i replaced the instruction with POP {R4-R11,PC}. This changes the error message to Error: invalid register list to push/pop instruction -- pop {R4-R11,PC}
I know that some older ARM chips had restrictions on what you could do with registers from R8 on, so, just for verification, i replaced the instruction with POP {R4-R7,PC}. And indeed, as assembles this well.
Now I don't know how to continue?
- Maybe I have to give another architecture option to as. But .arch armv7a seems to be the newest which is valid with android armv7a libraries.
- Maybe i'm completely off track, and the pop instruction is actually a macro for two separate instructions, which pop high and low registers after another. But, the result of entering the individual two-byte instructions (
BD E8,F0 8F) into the online disassembler seems to have nothing to do with popping from the stack.
I also tried disabling macros in IDA's processor options, which didn't change anything. So i'm inclined to think the byte sequence is a genuine 4 byte thumb mode opcode.
What else do i need to specify in my program to make gnu as recognize the instruction?
