> you will notice that the upper nybble of nearly every fourth byte is an “E”, these denote a number of different operations, including loading, storing, branching and standard arithmetic. When you see a binary file with data represented uniformly like this, you can be reasonably sure that it is running ARM code.
The 'E' nybble doesn't have much to do with the operation code. What it really is, is that more or less A32 instruction can be predicated by a condition code. 'E' means 'always execute this instruction' regardless of the current state of the flags.
The 'E' nybble doesn't have much to do with the operation code. What it really is, is that more or less A32 instruction can be predicated by a condition code. 'E' means 'always execute this instruction' regardless of the current state of the flags.