This is all documented in the ARM Architecture Procedure Call Standard (AAPCS) ARM IHI0042. There may be more recent versions. The short version: R0-R3 are for passing arguments, R12 is a scratch register for procedure calls (linker things, etc) and everything else must be preserved by functions that use it.
Typically, the push r5-r9 instruction is a way to save the content of these registers (ie r5, r6, r7, r8, r9) on the stack, then the pop r5-r9 is restoring the saved values before leaving the function stack-frame.
This is quite common behavior when you want to manipulate non-volatile registers within your stack-frame and be compliant to the ABI. It is ...
No, you can't assume that's how most ARM compilers will implement switch statements. For example, here's gcc 5.2.1 on that same code:
cosimo:~ moyix$ arm-none-eabi-gcc-5.2.1 -o3 -mthumb -c x.c -o x.o
cosimo:~ moyix$ arm-none-eabi-objdump -d x.o
x.o: file format elf32-littlearm
Disassembly of section .text:
0: b580 ...
when I set a breakpoint at say 0x010451
It's critical to first understand that there is actually no such valid address for an instruction.
On an ARM processor, instructions are always aligned to their width - 16 bit thumb instructions are aligned to 16 bits, 32 bit ARM instructions are aligned to 32 bits, etc.
Rather, such values that are not actually ...
After searching for the constant 'XLNX', it turns out this firmware file format is defined here. You're lucky because the encryption field is set to 0x0 (None).
Now the question is, what do you really want to do with this image? You only want to extract image files?
As you say, you have -
imm8 = 0010 0100
imm3 = 011
but you also have
i = 0
imm32 = ZeroExtend(i:imm3:imm8,32) =>
imm32 = ZeroExtend(0:011:00100100,32) =>
imm32 = ZeroExtend(001100100100,32) =>
imm32 = 00000000000000000000001100100100 = 0x00000324
The ADR instruction description explains that "This instruction adds an immediate value ...