IDA Help: ARM processor specifics

Since architecture version v4 (introduced in ARM7 cores), ARM processors have a new 16-bit instruction set called Thumb (the original 32-bit set is referred to as "ARM"). Since these two sets have different instruction encodings and can be mixed in one segment, we need a way to specify how to disassemble instructions. For this purpose, IDA uses a virtual segment register named 'T'. If its value is 0, then ARM mode is used. Otherwise, Thumb mode is used. ARM is the default mode. Please note that if you change the value of T register for a range, IDA will destroy all instructions in that range because their disassembly is no longer correct.

IDA use UAL (Unified Assembly Language) syntax by default which uses the same syntax for both ARM and Thumb mode. If necessary, legacy assembler syntax can be selected in Analysis options.

To decode Aarch64 (ARM64) instructions the segment with instructions must be set to 64-bit.

Processor options for ARM

Simplify instructions

      If this option is on, IDA will simplify instructions and replace
      them by clearer pseudo-instructions
      For example,

              MOV     PC, LR

      is replaced by

              RET

Disable pointer dereferencing

      If this option is on, IDA will not use =label syntax for
      loads from literal pools.
      For example,

                    LDR     R1, =dst
                    ...
      off_0_1003C   DCD dst

      will be shown as

                    LDR     R1, off_0_1003C

No automatic ARM-Thumb switch

      If this option is on, IDA will not propagate
      ARM-Thumb modes automatically when following jumps and calls.

Disable BL jumps detection

      Some ARM compilers in Thumb mode use BL (branch-and-link)
      instead of B (branch) for long jumps, since BL has more range.
      By default, IDA tries to determine if BL is a jump or a call.
      You can override IDA's decision using commands in Edit/Other menu
      (Force BL call/Force BL jump).
      If your target does not use this trick, you can set this option
      and IDA will always treat BL as a call.

Scattered MOVT/MOVW pairs analysis A pair of MOVT and MOVW instructions can be used to load any 32-bit constant into a register without having to use the literal pool. For example: MOVW R1, #0xABA2 MOVT R1, #0x32AA is simplified by IDA into MOV R1, 0x32AAABA2 (unless macro creation is turned off)

      However, if there is an unrelated instruction between them, such
      simplification is not possible. If you enable the conversion, then IDA will try to
      convert operands of even scattered instructions. The example above could be represented as:

      MOVW  R1, #:lower16:0x32AAABA2
      [other instructions]
      MOVT  R1, #:upper16:0x32AAABA2

      It is possible to select how aggressively IDA should try to handle such pairs:
      leave them as is, convert only if the result a valid address, or try to
      convert all pairs even if the result does not look like a valid address.

Edit ARM architecture options

      This button allows you to edit various features of the ARM architecture.
      This will affect the disassembly of some instructions depending on whether
      the selected architecture supports them. For details, see the ARM Architecture Reference Manual.

Command-line options

      You can configure the architecture options from the command line.
      For that, use the -parm:<option1[;option2...]> switch.
      The following options are accepted:

      ARMv<N>  - base ARM architecture version (e.g. ARMv4, ARMv4T,
                 ARMv5TE, ..., ARMv7-M, ARMv7-A)
       or

      <name>   - ARM core name (e.g. ARM7TDMI, ARM926EJ-S, PXA270,
                Cortex-M3, Cortex-A8)

      Additionally, a special name "armmeta" can be used to enable decoding of all known instructions.

      The options above will set some default values that can be adjusted further:

      NoVFP/VFPv<N>           - disable or enable support for VFP
                                instructions (e.g. VFPv3).
      NoNEON/NEON/NEON-FMA    - disable or enable support for NEON
                                (aka Advanced SIMD) instructions.
      NoThumb/Thumb/Thumb-2   - disable or enable support for Thumb (16-bit)
                                or Thumb-2 (16/32-bit) instructions.
      NoARM/ARM               - disable or enable support for ARM
                                instructions.
      XScale                  - support for XScale-specific instructions.
                                Implies ARMv5TE.
      NoWMMX/WMMXv1/WMMXv2    - support for Intel Wireless MMX
                                extensions (v1 or v2). Implies XScale.

See

      Change segment register value
      Set default segment register value

commands to learn how to specify the segment register value.Index | Previous topic | Next topic