assembly - How are encoded register operands in ARM assembler ? -

i decompiled arm elf files , read assembler code. but, don't see how codes translated mnemonics. example code this:

#hex code | #mnemonic             | #binary 0xb480    | push {r7}             | 1011 0100 1000 0000 0xb580    | push {r7, lr}         | 1011 0101 1000 0000 0xb5f0    | push {r4,r5,r6,r7,lr} | 1011 0101 1111 0000 

so, can see opcode push 0xb4 or 0xb5 if pushing multiple values. how list of registers created ?

the first example clear, r7 coded 8th bit, set. but, why second opcode pushes lr? there no bit flag ?

there 3 encodings of push instruction in thumb mode. first 1 16 bits long , exists since armv4t (original thumb implementation):

15141312|11|109|8|      7..0    |  1 0 1 1| 0| 10|m| register_list| 

since register_list 8 bits, can push registers r0 r7 (and lr, if m bit set).

in thumb-2 (armv6t2, armv7 , later), 2 more encodings have been added. both 32 bits long:

1514131211|109|876|5|4|3210||151413|    12 .. 0    |  1 1 1 0 1| 00|100|1|0|1101|| 0 m 0| register_list | 

in one, register_list 13 bits, can push r0 r12 , lr.

i won't list third encoding, can push single register.

btw, pop encodings similar.

16-bit pop:

15141312|11|109|8|      7..0    |  1 0 1 1| 1| 10|p| register_list| 

can pop r0 r7 , pc (bit p).

32-bit pop multiple:

1514131211|109|876|5|4|3210||151413|    12 .. 0    |  1 1 1 0 1| 00|010|1|0|1101|| p m 0| register_list | 

can pop r0 r12, pc (bit p) , lr (bit m).