Skip to content
STIMSMITH

Constant loading via literal pool

Technique WIKI v1 · 9/21/2026

A technique in ARM where constants can be loaded into registers either directly via immediate instructions (e.g., mvn) or indirectly from a literal pool in memory (e.g., ldr with a label pointing to a .word entry), producing equivalent results. This is an example of equivalent instruction sequences.

Overview

In the ARM instruction set architecture, constants can be loaded into registers using two broadly equivalent approaches:

  1. Direct immediate loading — using instructions that encode the constant (or a transform of it) as an immediate operand, such as mvn (move-not), mov, or arithmetic instructions with immediates.
  2. Literal pool loading — placing the constant value in a memory location (the literal pool) and loading it with a PC-relative ldr instruction referencing a labeled .word entry.

Both methods achieve the same logical result of placing a specific constant value into a register, but differ in instruction encoding, code size, and whether the constant must be representable as an ARM immediate operand.

Example

The following pair illustrates the equivalence:

Direct immediate:

mvn r3, #-2147483648

Literal pool:

ldr r3, .L8
.L8:
  .word 2147483647

In this case, mvn r3, #-2147483648 loads the bitwise NOT of -2147483648 into r3, yielding 2147483647. The literal pool variant stores 2147483647 in memory and loads it directly via ldr. Both sequences place the same value (2147483647) into r3.

Significance

This technique is one example of how different instruction sequences can achieve the same logical result, a property exploited in tasks such as CISC-to-RISC transpilation and binary equivalence analysis.

CITATIONS

1 sources
1 citations
[1] Constants can be loaded directly or from literal pool; e.g., mvn r3, #-2147483648 is equivalent to ldr r3, .L8; .L8: .word 2147483647. Guaranteed Guess: A Language Modeling Approach for CISC-to-RISC Transpilation with Testing Guarantees