2

I have the firmware in which mod operation must be done. I want to find this part of instructions.

Assume the following logic exist in the firmware:

res = var % 17

I have tried to make search by % 0x11 using IDA pseudocode and python but it does not find anything. Also I have tried to use gcc to dissemble this mod operation written in C but without any success.

Architecture: armv7-m

CPU: cortex-m4

1
  • I can't say for certain but one thing to look for would be division by multiplication which could be involved in a modulo calculation. In short, look for a multiplication by a weird/large constant then a right shift by floor(log2(17)) = 4. May 19 at 15:05

1 Answer 1

2

An option in these cases is to compile a relevant code snippet with appropriate architecture options and see what assembly is generated.

For example, take this code.

long mod17( long x )
{
    return x % 17;
}

Compiling it with gcc -mcpu=cortex-m4 -O2, gives -

mod17(long):
        ldr     r3, .L3
        smull   r3, r2, r3, r0
        asrs    r3, r0, #31
        rsb     r3, r3, r2, asr #3
        add     r3, r3, r3, lsl #4
        subs    r0, r0, r3
        bx      lr
.L3:
        .word   2021161081    // 0x78787879

The output assembly gives some clues that you could look for in your firmware -

  • the 'magic' constant 0x78787879
  • a multiplication instruction closely followed by 3 instructions containing shifts

Tests of similar code using int instead of long results in the same magic constant.

However, using unsigned integers results in a different magic constant - 0xF0F0F0F1 and just 1 shift instruction so you might want to look for these too.

(Compulsory godbolt link.)

1
  • As I wrote in my question I tried to do exactly what you have done but I am unable to find any magic constants or similar sequence of commands.
    – ALEX
    May 19 at 22:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.