Reverse Engineering for Beginners

CHAPTER 20. LINEAR CONGRUENTIAL GENERATOR CHAPTER 20. LINEAR CONGRUENTIAL GENERATOR

ret 0
my_srand ENDP

_TEXT SEGMENT
my_rand PROC
imul eax, DWORD PTR rand_state, 1664525 ; 0019660dH
add eax, 1013904223 ; 3c6ef35fH
mov DWORD PTR rand_state, eax
and eax, 32767 ; 00007fffH
ret 0
my_rand ENDP

_TEXT ENDS

GCC compiler generates mostly the same code.

20.3 32-bit ARM

Listing 20.4: Optimizing Keil 6/2013 (ARM mode)

my_srand PROC
LDR r1,|L0.52| ; load pointer to rand_state
STR r0,[r1,#0] ; save rand_state
BX lr
ENDP

my_rand PROC
LDR r0,|L0.52| ; load pointer to rand_state
LDR r2,|L0.56| ; load RNG_a
LDR r1,[r0,#0] ; load rand_state
MUL r1,r2,r1
LDR r2,|L0.60| ; load RNG_c
ADD r1,r1,r2
STR r1,[r0,#0] ; save rand_state
; AND with 0x7FFF:
LSL r0,r1,#17
LSR r0,r0,#17
BX lr
ENDP

|L0.52|
DCD ||.data||
|L0.56|
DCD 0x0019660d
|L0.60|
DCD 0x3c6ef35f

AREA ||.data||, DATA, ALIGN=2

rand_state
DCD 0x00000000

It’s not possible to embed 32-bit constants into ARM instructions, so Keil has to place them externally and load them addi-
tionally. One interesting thing is that it’s not possible to embed the 0x7FFF constant as well. So what Keil does is shifting
rand_stateleft by 17 bits and then shifting it right by 17 bits. This is analogous to the(rand_state≪17)≫ 17 statement
in C/C++. It seems to be useless operation, but what it does is clearing the high 17 bits, leaving the low 15 bits intact, and
that’s our goal after all.

Optimizing Keil for Thumb mode generates mostly the same code.

20.4 MIPS

Listing 20.5: Optimizing GCC 4.4.5 (IDA)

my_srand: