例:
Code:0001835A LDR R4, =byte_20002188 Hex: 18 4C
...
Code:000183BC Hex: 88 21 00 20
Cortex-M0 所用指令集为 Armv6-M,大部分为thumb指令,2字节;
Armv6-M Architecture Reference Manual
03bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6V1k6i4k6W2L8r3!0H3k6i4u0Q4x3X3g2S2M7X3#2Q4x3X3g2U0L8$3#2Q4x3V1k6V1L8$3y4#2L8h3g2F1N6r3q4@1K9h3!0F1i4K6u0r3k6r3c8A6x3o6b7I4z5g2)9J5c8X3I4S2N6r3g2K6N6q4)9J5c8R3`.`.
解析opcode时,与x86 不同的是,opcode字节也是小尾序;
例如上面 "18 4C",则第一个字节是 '4C' == 0b01001100;
手册中有书签(目录),直达 A5.2 16-bit Thumb instruction encoding;
可见前五 bit 符合 01001x Load from Literal Pool,点进链接里;
LDR <Rt>, <label>
(5bit) (3bit)(8bit)
4C (01001 100) 18(00011000)
中间3bit 为 0b100 == 4; 则寄存器 为 R(4);
后8bit,imm32 = ZeroExtend(imm8:‘00’, 32);
意思是给这8bit后面再添两个0 变为 0b1100000 == 0x60;
整条指令的意思是:
R4 = dword ptr [PC + 0x60 + 2];
PC + 0x60 + 2 = 0x1835A + 0x60 + 2 = 183BC;
dword ptr [PC + 0x60 + 2] = 0x20002188;
R4 = 0x20002188;
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
Black.WuKong 滥竽充数