Identify mod operation in ARM firmware with IDA

Question

I have the firmware in which mod operation must be done. I want to find this part of instructions.

Assume the following logic exist in the firmware:

res = var % 17

I have tried to make search by % 0x11 using IDA pseudocode and python but it does not find anything. Also I have tried to use gcc to dissemble this mod operation written in C but without any success.

Architecture: armv7-m

CPU: cortex-m4

Answer 1

An option in these cases is to compile a relevant code snippet with appropriate architecture options and see what assembly is generated.

For example, take this code.

long mod17( long x )
{
    return x % 17;
}

Compiling it with gcc -mcpu=cortex-m4 -O2, gives -

mod17(long):
        ldr     r3, .L3
        smull   r3, r2, r3, r0
        asrs    r3, r0, #31
        rsb     r3, r3, r2, asr #3
        add     r3, r3, r3, lsl #4
        subs    r0, r0, r3
        bx      lr
.L3:
        .word   2021161081    // 0x78787879

The output assembly gives some clues that you could look for in your firmware -

• the 'magic' constant 0x78787879
• a multiplication instruction closely followed by 3 instructions containing shifts

Tests of similar code using int instead of long results in the same magic constant.

However, using unsigned integers results in a different magic constant - 0xF0F0F0F1 and just 1 shift instruction so you might want to look for these too.

(Compulsory godbolt link.)