Abstract

• Like MIPS, ARM instructions are 4 bytes in size, so a single instruction is not sufficient to directly load a full memory address.

• To solve this, ARM stores addresses between functions and accesses them when needed.

Addressing Method in ARM

• Using tools like Binwalk, you can locate function epilogues in a binary.

  

• If you navigate to the identified location, you can see that between the function epilogue and the next function prologue, raw addresses (not instructions) are stored.

  

• These stored memory addresses are accessed using offsets relative to the instruction’s location.