title: How does 'BL' arm instruction disassembly work?
body: <p>'bl' or branch with link instruction is almost always becomes 0xebfffffe</p>
  
  <p>However, the processor and GNU binutils objdump somehow know where to branch:</p>
  
  <pre><code>00000000 &lt;init_module&gt;:
     0:   e1a0c00d        mov     ip, sp
     4:   e92ddff0        push    {r4, r5, r6, r7, r8, r9, sl, fp, ip, lr, pc}
     8:   e24cb004        sub     fp, ip, #4
     c:   e24dd038        sub     sp, sp, #56     ; 0x38
    10:   ebfffffe        bl      0 &lt;init_module&gt;
    14:   e59f0640        ldr     r0, [pc, #1600] ; 65c &lt;init_module+0x65c&gt;
    18:   ebfffffe        bl      74 &lt;init_module+0x74&gt;
  </code></pre>
  
  <p>How do they know?</p>