How does 'BL' arm instruction disassembly work?

Question

'bl' or branch with link instruction is almost always becomes 0xebfffffe

However, the processor and GNU binutils objdump somehow know where to branch:

00000000 <init_module>:
   0:   e1a0c00d        mov     ip, sp
   4:   e92ddff0        push    {r4, r5, r6, r7, r8, r9, sl, fp, ip, lr, pc}
   8:   e24cb004        sub     fp, ip, #4
   c:   e24dd038        sub     sp, sp, #56     ; 0x38
  10:   ebfffffe        bl      0 <init_module>
  14:   e59f0640        ldr     r0, [pc, #1600] ; 65c <init_module+0x65c>
  18:   ebfffffe        bl      74 <init_module+0x74>

How do they know?

Answer 1

The issue is caused by the fact that you're looking at the disassembly of an object file, not final executable or shared object.

When assembler is producing the object file, the final address of the bl target is not fixed yet (it depends on the other object files that will be linked with it). So the assembler sets the address to 0 but also adds a relocation that tells the linker where this bl is supposed to go in the final file. (You can see the relocation info in objdump by adding the -r switch.)

When linking, the linker processes the relocation, calculates the final address of the target function and patches the instruction so that the target address lines up. If you disassemble the final, linked executable, you will see a different opcode.