5

I have an iPhone app that I am disassembling.

It is my understanding that a CBNZ instruction is "Compare and Branch on Non-Zero." and a CBZ is "Compare and Branch on Zero"

I can not find anywhere online to confirm this but to me it seems that CBNZ is represented by B9 in an address like so "0x B9 DC" and CBZ is "0x B3 DC".

The full address is: DC B9 53 48 03 99 78 44 00 68 BF F1 74 EE 51 49

I am modifying it to: DC B3 53 48 03 99 78 44 00 68 BF F1 74 EE 51 49

Previously I had patched this same check in ARMv6 though it was represented by a BNE "0x D1 30" that I patched to a B "0x E0 32"

This: 32 D1 5B 48 5C 49 78 44 79 44 00 68 09 68 AC F1

To: 32 E0 5B 48 5C 49 78 44 79 44 00 68 09 68 AC F1

This behaved exactly how I expected to, taking the branch and continuing on as I wanted it to. Normally it only takes such branch if it passes a check.

I figured patching a CBNZ to a CBZ would have similar results though it seems not.

Hope someone can help me understand. Sorry if this is not a forum where I should post questions like this though it seems like a good place to ask. If you need more info I will be happy to provide.

4
  • this is documented in an easy to find place. the arm documents for that processor. go to infocenter.arm.com -> arm architecture -> reference manuals. and get the armv7-m manual. You threw me off by saying ARM7 which is an ARMv4 and does not have this instruction, this instruction is only supported in the armv7-m at this time. there is no arm6 do you mean armv6? the thumb bne instruction is also found in the same armv7-m arch reference manual, or any prior arch reference manual back to the armv4t.
    – old_timer
    Feb 14, 2012 at 19:09
  • actually the armv7-ar manual has it as well.
    – old_timer
    Feb 14, 2012 at 19:16
  • Sorry about that I did mean ARMv6 and ARMv7. I actually did not know there was a difference, I am a noob at this for now. Feb 14, 2012 at 19:46
  • the opcodes are documented in the ARM ARM (ARM Architectural Reference Manual). Used to be just one ARM ARM for everything now there is one per family. The newer ARM ARMs like the armv7-ar ARM ARM will list, per instruction, what architecture supports it, for example the CBNZ/CBZ is armv7 only which is why you may not have seen it or the compiler may not have used it on an armv6.
    – old_timer
    Feb 14, 2012 at 20:54

1 Answer 1

12

To understand the assembly, you need to go to bit level. If you don't want to spend time to understand the ARM encoding, get a disassembler (e.g. otool -tV) and an assembler (e.g. as) and they will figure out the instruction encoding/decoding for you.


The encoding of the CBZ/CBNZ instructions are

15 14 13 12 11 10  9  8  7  6  5  4  3  2  1  0   <-- bit
 1  0  1  1 op  0  i  1 [         imm5][     Rn]  <-- meaning

where op = 1 means CBNZ, op = 0 means CBZ, 'i :imm5:0' is the relative address to jump, and Rn is the register to check (see ARMv7-ARM §A8.6.27).

Therefore, the word B9DC, in binary,

(1  0  1  1 op  0  i  1 [         imm5][     Rn])
 1  0  1  1  1  0  0  1 [1  1  0  1  1][1  0  0]

means

  • op = 1
  • i = 0
  • imm5 = 11011
  • Rn = 100

means

CBNZ R4, (PC+54)   ; 54 = 0b0110110

while B3DC, in binary,

(1  0  1  1 op  0  i  1 [         imm5][     Rn])
 1  0  1  1  0  0  1  1 [1  1  0  1  1][1  0  0]

means

  • op = 0
  • i = 1
  • imm5 = 11011
  • Rn = 100

means

CBZ R4, (PC+118)  ; 118 = 0b1110110

Note that your patch B9B3 changed the i bit as well, which changed the address it should jump to. You should only change the op bit, meaning you should patch the byte as B1.

3
  • Thank you for breaking it down for me. Unfortunately I had already tried B1 simply out of guesswork and it did not work the way I had hoped it would. I use IDA Pro and it seemed everything was how I wanted it when I used B1 but the app crashed. Do you have any insight as to why, I can post a bigger portion of the assembly if you need it. Feb 14, 2012 at 19:56
  • Do you think I should change it something other than CBZ? Feb 14, 2012 at 20:14
  • @Untouchable don't know what you want to do. If you have another question, you should post a new one.
    – kennytm
    Feb 14, 2012 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.