I'm trying to understand ARM instruction encoding.

The following image shows C code along with its corresponding assembly instructions:

enter image description here

I looked at the ARMv7 reference manual. However, I couldn't find the relationship between the machine code and the corresponding assembly instruction.

For example,

I couldn't relate the machine code


to the assembly instruction

sub.w sp, sp, #8

Could you help me with this?


Based on the answers and after looking at the reference manual, I added the following information.

The processor name is Cortex-M4F.

The processor architecture of the microcontroller I use is ARMv7.

Specifically, the microcontroller profile employed is ARMv7-M.

From the manual:

ARMv7-M The microcontroller profile for systems supporting only the Thumb instruction set, and where overall size and deterministic operation for an implementation are more important than absolute performance.

  • 2
    \$\begingroup\$ ARM version numbering is horrendously confusing. The number on the chip (no V) is completely unrelated to the version of the instruction set (with a V). e.g. "ARM926EJ-S" chips use the "ARMv5TE" archite3cture. My "not ARM7" comment left out the V and should in any case have said "not 32-bit ARM". dwelch is correct. \$\endgroup\$
    – pjc50
    Jun 14, 2016 at 11:33
  • 1
    \$\begingroup\$ arm7 is the marketing name that uses armv4, arm9 uses armv5, arm11 uses armv6, then you get into the cortex-a and cortex-r which use armv7 (or armv8). armv7 != arm7. one term is the architectural numbering the other is a product name \$\endgroup\$
    – old_timer
    Jun 14, 2016 at 13:34
  • 1
    \$\begingroup\$ and there is enough of a difference between armv7(-ar) and armv7-m that if you are talking about the armv7-m it is a good idea to put the m out there. \$\endgroup\$
    – old_timer
    Jun 14, 2016 at 13:34
  • 1
    \$\begingroup\$ yes confusing, painful, detailed, etc. the alternative is to generically say x86 to cover a myriad of processors that are different internally (or to use their code names, ivy bridge, sandy bridge, etc, which is even confusing as some are the same architecture on a different technology 14nm instead of 22) \$\endgroup\$
    – old_timer
    Jun 14, 2016 at 13:36
  • 1
    \$\begingroup\$ for this particular question, the decoding of these instructions is covered in both the armv7-m and armv7-ar architectural reference manuals as thumb2 is supported in both. \$\endgroup\$
    – old_timer
    Jun 14, 2016 at 13:38

4 Answers 4


The ARMv7-M reference manual does not have a decode lookup table, but the encoding for each instruction is listed.

In the specific manual you have linked, you will find this in the section A6.7 - Alphabetical list of ARMv7-M Thumb instruction.

This contains - as stated - a list of every instruction, and their corresponding binary encoding. For example, page A6-16 has the binary encoding for the ADC (immediate) instruction. We can see that it starts with 11110... and spans two words.

The problem is going "backwards". The manual does indeed contain all the necessary information, but it is difficult to search. The disassembler has the data structures in place to do that for you, and if you want a table and do it manually, I suggest looking at the source code files for an ARM disassembler, for example GNU binutils.

  • \$\begingroup\$ Worth noting, as the 68000-architecture fanboy I am, is that the M68000PM/AD reference manual for the 68000 instruction set do contain this reverse table, ordered in binary order, making this lookup trivial. \$\endgroup\$
    – pipe
    Jun 13, 2016 at 10:01
  • \$\begingroup\$ A quick look through the binutils sources shows, that the code for the ARM disassembler can be found here \$\endgroup\$
    – erebos
    Jun 13, 2016 at 11:15

In the ARMv7-m ARM that I am looking at encoding T3 for subtract immediate which is supported by ARMv7-M architecture is in the form

SUB{S}<c>.W <Rd>,<Rn>,#<const>

the bit pattern 11110i01101S.... which matches with the 0xF1A of the instruction, sp is 13 and the two instances of 0XD in the encoding line up with that along with the immediate #8.

If you look at LDR (literal) the encoding is 0x4800 with a register and immediate. this instruction as documented does a pc relative load, so the pc is implied. likewise this is a 32 bit load, so when we assume 32 bit alignment the offset makes sense 0x34 is 110100, being 32 bit aligned we dont need the lower two bits they burn instruction space so 1101 which is a 0x0D giving 0x490D as the encoding.

It is all right there in the document you are looking at.



490D : the '4' = 0100 and '9' = 1001, so the top five bits are 01001. Looking down the table shows that as "PC relative load". The next three bits are 001 for 'Rd', the destination register. The operand is 'D', which multiplied by 4 to count words is 0x34.

F1AD0D08 is a bit strange. Someone else can try that one.


I thought I'd mention at this late date that the current version of the ARMv7m Architecture Reference Manual does have Chapter 5 "The Thumb Instruction Set Encoding" that is helpful for decoding CM4 instructions. It's still pretty difficult, because essentially the instruction set is really ugly and not at all regular :-(

But for your F1AD0D08 (1111 0001 1010 1101 0D 08):

If bits [15:11] of the halfword being decoded take any of the following values, the halfword is the first halfword of a 32-bit instruction: [goto "32-bit Thumb instruction encoding" on page n]

111 10 x1xxxxx -> Data processing (plain binary immediate) [Page a5-141]

111 10 x1 01010 -> SUB (immediate) [page a7-402]

(that's the individual subtract instruction description. We see that we match enoding T4) 11110 i1 01010 1101 ... -> oops. "if Rn = 1101, see SUB (SP minus immediate) [a7-406]

So now we're at encoding T3 of SUB (SP minus immediate) 11110 i1 01010 1101 0 imm3 rd imm8

Where we put together a 12bit immediate value i:imm3:imm8, which in your case is 8, and Rd is 0d (r13, or SP.)

Ta Da!


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.