Reverse Engineering for Beginners

CHAPTER 16. REPLACING ARITHMETIC INSTRUCTIONS TO OTHER ONES CHAPTER 16. REPLACING ARITHMETIC INSTRUCTIONS TO OTHER ONES

mov ebp, esp
mov eax, DWORD PTR _a$[ebp]
shl eax, 2
pop ebp
ret 0
_f ENDP

Multiplication by 4 is just shifting the number to the left by 2 bits and inserting 2 zero bits at the right (as the last two bits).
It is just like multiplying 3 by 100 —we need to just add two zeroes at the right.

That’s how the shift left instruction works:

7 6 5 4 3 2 1 0

CF 7 6 5 4 3 2 1 0 0

The added bits at right are always zeroes.

Multiplication by 4 in ARM:

Listing 16.3: Non-optimizing Keil 6/2013 (ARM mode)

f PROC
LSL r0,r0,#2
BX lr
ENDP

Multiplication by 4 in MIPS:

Listing 16.4: Optimizing GCC 4.4.5 (IDA)

jr $ra

sll $v0, $a0, 2 ; branch delay slot

SLL is “Shift Left Logical”.

16.1.3 Multiplication using shifting, subtracting, and adding

It’s still possible to get rid of the multiplication operation when you multiply by numbers like 7 or 17 again by using shifting.
The mathematics used here is relatively easy.

32-bit

#include <stdint.h>

int f1(int a)
{
return a*7;
};

int f2(int a)
{
return a*28;
};

int f3(int a)
{
return a*17;
};

x86