Search code examples
assemblyarmpatchmonkeypatching

ARM LDR instruction on PC register


Here how I understand the story:

  • PC register holds pointer to next instruction
  • LDR instruction is loading the value of second operand into first operand (for example)
    LDR r0, [pc, 0x5678]
    is equivalent to this "C code"
    r0 = *(pc + 0x5678)
    
    It's pointer dereferencing with base offset.

And my question:

I found this code

LDR PC, [PC,-4]

It's commented like monkey patching, etc..

How I understand this code

pc = *(pc - 4)

I this case "pc" register will dereference the address of previous instruction and will contain the "machine code" of instruction (not the address of instruction), and program will jump to that invalid address to continue execution, and probably we will get "Segmentation Fault". So what I'm missing or not understanding?



The thing that makes me to think is the brackets of second operand in LDR instruction. As I know on x86 architecture brackets are already dereferencing the pointer, but I can't understand the meaning in ARM architecture.

mov r1, 0x5678
add r1, pc
mov r0, [r1]

is this code equivalent to?

LDR r0, [pc, 0x5678]

Solution

  • Quoting from section 4.9.4 of the ARM Instruction Set document (ARM DDI 0029E):

    When using R15 as the base register you must remember it contains an address 8 bytes on from the address of the current instruction.

    So that instruction will load the word located 4 bytes after the current instruction, which hopefully contains a valid address.