Isolating a number in an integer multiplication in assembly?

Question

If my EAX register is 0xFC000000 and my ESI register is 0xF9FDEFF3, doing :

imul esi,eax

Would store 0x34000000 in the ESI register. The result of the multiplication is 0xF615F83334000000 but since the program is in 32bit it will truncate it to 0x34000000 and it is unsigned. Now my question is, if I only had my ESI register (0xF9FDEFF3) and the truncated result of the multiplication (0x34000000), how would I go about finding my EAX register?

Thanks in advance

Note : the values of EAX and ESI are completely random, I used those numbers just to show an example.

Answer 1

In general you can't "un-multiply", but in some cases you can: those cases where the number you know is odd. (also, of course, the cases in which you know there was no overflow so you can un-multiply with a plain old division, but imul doesn't tell you about unsigned overflow)

Odd numbers have a modular multiplicative inverse modulo 2 ³² (indeed modulo any power of two, because a power of two only contains twos in its factorization and an odd number contains no twos, so the gcd of them will be 1).

So supposing we know esi was 0xF9FDEFF3 and the result of the multiplication was 0x34000000, we can calculate the inverse of 0xF9FDEFF3 this way: ( edi is the input)

lea ecx, [edi + 1]
mov eax, 2
mov esi, eax
imul    ecx, edi
sub ecx, 1
mov edx, ecx
imul    edx, edi
sub esi, edx
imul    ecx, esi
mov esi, eax
mov edx, ecx
imul    edx, edi
sub esi, edx
mov edx, esi
imul    edx, ecx
imul    edi, edx
sub eax, edi
imul    eax, edx

It turns out to be 0x657f413b. Now 0x657f413b * 0x34000000 = 0x149DD93FFC000000, truncated to 0xFC000000.

If the number you know is even, you can still solve known * x == output for x , but there could be no solutions or many, never one. You can think of this as actually being output = (k * x) << d , where known = 2 ^d k (with k odd), it should be clear then that the d lower bits of the output had better be zero or there will be no solution, and if they are zero then the d upper bits of x can be anything.