Link to this headingARM

• Reduced Instruction Set Computing (RISC)
  • Less than 100 Instructions
  • Instructions only operate on Registers
  • ONLY Load/Store instructions can access memory.
• Instructions can be used for Continual Execution
• ARMv3 and earlier use little-endian format for data
• ARMv4 and later use Big-endian format by default but allows for switchable endian-ness for data
• Uses little-endian format for Instructions

ARM Mode:

• R15 Program Counter is always 4 bytes

Link to this headingWriting Assembly

Use as to transform ASM file to object file
Use ld to link object files to binary

.string is null terminated
.ascii in not null terminated

Link to this headingInstructions

Barrel Shifter can be used to shrink multiple instructions into one.

• Rx, ASR n: Register x with arithmetic shift right by n bits (1 = n = 32)
• Rx, LSL n: Register x with logical shift left by n bits (0 = n = 31)
• Rx, LSR n: Register x with logical shift right by n bits (1 = n = 32)
• Rx, ROR n: Register x with rotate right by n bits (1 = n = 31)
• Rx, RRX: Register x with rotate right by one bit, with extend

Examples:

Link to this headingIntermediate Values in ARM

Using any Intermediate value in arm can only be represented in 8bits with a bit shift throughout the 32bit.

Link to this headingData Types

• Signed data: Smaller Range of Numbers but can have negative

• Unsigned data: Large Range including zero

• ldr: Load Word

• ldrh: Load unsigned Half Word

• ldrsh: Load signed Half Word

• ldrb: Load unsigned Byte

• ldrsb: Load signed Bytes

• str: Store Word

• strh: Store unsigned Half Word

• strsh: Store signed Half Word

• strb: Store unsigned Byte

• strsb: Store signed Byte

Link to this headingRegisters

• 30 General Purpose 32-bit Registers
• First 16 (R0-R15 General Purpose Registers) are accessible in User-Level Mode
  • R7 (Holds Syscall Number)
  • R11 (Base Frame Pointer) Points to the bottom of the stack
  • R12 (Intra Procedural Call)
  • R13 (Stack Pointer) Controls the Pointer to the top of the stack where the top element of the stack is.
  • R14 (Link Register) Used to store the Return address
  • R15 (Program Counter)
    • When a Branch/Jump is executed holds the destination address
    • Otherwise holds two arm instructions after the Current instruction (Older Arm processors fetched instructions two ahead and is kept to insure compatibility)
• Control Program Status Register (CPSR)
  • Bit 0-4: (Processor/Privilege Mode)
  • Bit 5: (Thumb) 1 when in Thumb
  • Bit 6: (FIQ disable)
  • Bit 7: (IRQ disable)
  • Bit 8: (Abort disable)
  • Bit 9: (Endian-ness) 0 for little-endian 1 for big-endian
  • Bit 10-15: ???
  • Bit 16-19: ???
  • Bit 24: (Jazelle bit) Allows some ARM processors to execute Java bytecode in hardware.
  • Bit 25-26: ???
  • Bit 27: (Underflow)
  • Bit 28: (Overflow) Set when the result of an add, subtract, or compare is greater than or equal to 231, or less than 2^31.
  • Bit 29: (Carry)
    • Set when result of an addition is greater than or equal to 2^32
    • Set when result of a subtraction is positive or zero
    • Set when an inline barrel shifter operation in a move or logical instruction.
  • Bit 30: (Zero) 1 when result is zero
  • Bit 31: (Negative) 1 when result is negative

Example:

Link to this headingConditionals

These conditionals below can be added to the end of any ARM instruction and will only execute when the flag is in the correct state.

Example:

Link to this headingIF-THEN-(Else) Conditional Instruction

This is a simple switch instruction for assembly

• IT: refers to If-Then (If TRUE then execute the next instruction)
• ITT: refers to If-Then-Then (If TRUE then execute the next 2 instructions)
• ITE: refers to If-Then-Else (If TRUE then execute the next instruction, If FALSE skip the next instruction and execute the one after that)
• ITTE: refers to If-Then-Then-Else (If TRUE then execute the next 2 instructions and skip the next one, If FALSE skip 2 instructions and execute the one after that)
• ITTEE: refers to If-Then-Then-Else-Else (If TRUE then execute the next 2 instructions and skip the next 2 instructions after that, If FALSE skip 2 instructions and execute the two after that)

Example:

Link to this headingBranching

Branch (B): Simple jump to a function
Branch link (BL): Saves the program counter (PC+4) in LR register and jumps to function
Branch exchange (BX): Simple jump to a function but switch instruction set (ARM <-> Thumb)
Branch link exchange (BLX): Saves the program counter (PC+4) in specified register and jumps to function

Switch THUMB Mode:

Conditional Branch Example:

Link to this headingStack

Stack can be Grow up or down.

If the stack grows up it is a descending Stack.
If the stack grows down it is a ascending Stack.

If the stack points to an object then its a full stack
If the stack points to an null before the stack starts then its an empty stack.

Link to this headingThumb Mode

Thumb-1:

• 16 bit Instructions
• R15 Program Counter is always 2 bytes
• Used in ARMv6 and earlier

Thumb-2:

• Extends Thumb-1
• 16 bit or 32 bit Instructions
  • 32bit instructions have a .w added to the instruction
• Used in ARMv6T2, ARMv7
• R15 Program Counter is always 2 bytes
• Conditional Execution using the IT instruction

ThumbEE:

• code compiled on the device either shortly before or during execution.

Link to this headingSwitching state

Switching to Thumb mode:

1. Use the BX (Branch Exchange) or the BLX (Branch Link and Exchange) and set the least significant bit destination register to 1.
   • This does not cause alignment issues because the processor will ignore the last bit.
2. We know that we are in Thumb mode if the T bit in the current program status register is set.

Link to this headingEmulating ARM with Unicorn