ARM BL指令目标地址计算：如何从十六进制字节28 7D CB EB得到011ECE54

Let's break this down step by step—ARM's BL (Branch with Link) instruction can feel a bit opaque at first, but once we walk through the math with your specific byte sequence and target address, it'll make total sense.

Core Logic of BL Address Calculation #

BL uses a 24-bit signed offset encoded directly in the instruction to find its target. The formula boils down to:

Target Address = Current PC Value + (Sign-Extended 24-bit Offset << 2)

A critical note here: On ARM, when executing a BL instruction, the PC register holds the address of the instruction two steps ahead of the current BL—so that's Current BL Instruction Address + 8 (thanks to the classic ARM 3-stage pipeline).

Step-by-Step Derivation for 28 7D CB EB → 011ECE54 #

1. Convert the byte sequence to a 32-bit instruction word

Most ARM systems use little-endian storage (lowest byte stored at the lowest memory address). Our byte sequence 28 7D CB EB is stored as:

• Byte 0 (lowest address): 0x28
• Byte 1: 0x7D
• Byte 2: 0xCB
• Byte 3 (highest address): 0xEB

To get the full 32-bit instruction, we reverse the order and combine them:

0xEB << 24 | 0xCB << 16 | 0x7D << 8 | 0x28 = 0xEBCB7D28

2. Extract the 24-bit signed offset

The 24-bit offset lives in the low 24 bits of the BL instruction. We isolate it with a bitwise AND:

0xEBCB7D28 & 0xFFFFFF = 0xCB7D28

Notice the highest bit of this 24-bit value is 1 (since 0xCB is 11001011 in binary)—this means it's a negative offset.

3. Sign-extend the offset to 32 bits

Since our 24-bit offset is negative, we fill all the upper 8 bits of the 32-bit value with 1s to preserve its sign:

0xFFCB7D28

In decimal, this is -1384184.

4. Shift the offset left by 2 bits

ARM instructions are 4-byte aligned, so the offset counts in "words" (4 bytes) instead of individual bytes. Shifting left by 2 bits is equivalent to multiplying by 4, converting it to a byte offset:

0xFFCB7D28 << 2 = 0xFD35F4A0

In decimal, this is -5536736 (or -0xD20B60 in hex).

5. Calculate the current PC value

We know the target address is 0x011ECE54, so we rearrange our core formula to solve for PC:

PC = Target Address - (Shifted Offset)

Plugging in the values (remembering the shifted offset is negative, so subtracting it becomes adding its positive equivalent):

PC = 0x011ECE54 - 0xFD35F4A0 = 0x011ECE54 + 0xD20B60 = 0x01F0D9B4

6. Verify the full calculation

Recall that PC = Current BL Instruction Address + 8, so the BL instruction is at:

0x01F0D9B4 - 8 = 0x01F0D9AC

Now let's plug everything back in to confirm:

• PC value: 0x01F0D9AC + 8 = 0x01F0D9B4
• Shifted offset: -0xD20B60
• Target address: 0x01F0D9B4 - 0xD20B60 = 0x011ECE54

Perfect—this matches exactly the target address you provided!

内容的提问来源于stack exchange，提问作者Arsalan Awan