GoSudaAnalysis of AMD64 Assembly Code Generation and Branch Instructions for Go Conditional Statements (if)
If Statements in the Go Language
First, the reason we chose Go is that, among modern languages, Go has the most "beautiful" assembly, and its syntactic efficiency is sometimes overwhelming even when compared with classical languages.
Now that we have understood how a simple Go program works from the previous lecture, let us compare Go and Assembly line by line.
Source Code
First, as is the case with Go, modern compilers, including GCC, automatically optimize branches that serve no purpose. GCC and Clang, which are C language compilers, also perform very aggressive optimizations at -O2, the industry standard, so the era in which programmers could hardly trust compilers fully was, in fact, completed in the late 20th century.
Therefore, from the compiler's perspective, a condition must be given that is difficult to predict and replace with a different construct; only then does it have meaning.
1package main
2
3import (
4 "os"
5 "strconv"
6)
7
8func main() {
9 // If this were handled with something predictable and removable, such as x = 10,
10 // the compiler would optimize it and remove the branch.
11 // Therefore, to inspect such code directly as assembly, in C one would use -O0 or similar,
12 // or otherwise make the compiler use an external value it cannot predict,
13 // but since this section deals with modern programming, we will not use the method of
14 // disabling Go's binary optimizations.
15 if len(os.Args) < 2 {
16 return
17 }
18 x, _ := strconv.Atoi(os.Args[1])
19
20 if x < 10 {
21 println("X is smaller than 10")
22 } else {
23 println("X is larger or same as 10")
24 }
25}
In this case, since the compiler cannot predict the input, the branch statement is translated into machine code as is.
Assembly Language
1TEXT main.main(SB) /home/yjlee/introduction-to-golang/learn-golang/if-and-switch/golang-if/main.go
2 main.go:8 0x47a840 493b6610 CMPQ SP, 0x10(R14)
3 main.go:8 0x47a844 7670 JBE 0x47a8b6
4 main.go:8 0x47a846 55 PUSHQ BP
5 main.go:8 0x47a847 4889e5 MOVQ SP, BP
6 main.go:8 0x47a84a 4883ec10 SUBQ $0x10, SP
7 main.go:15 0x47a84e 48833d12fb0a0002 CMPQ os.Args+8(SB), $0x2
8 main.go:15 0x47a856 7c58 JL 0x47a8b0
9 main.go:15 0x47a858 488b0d01fb0a00 MOVQ os.Args(SB), CX
10 main.go:18 0x47a85f 488b4110 MOVQ 0x10(CX), AX
11 main.go:18 0x47a863 488b5918 MOVQ 0x18(CX), BX
12 main.go:18 0x47a867 e834e8ffff CALL strconv.Atoi(SB)
13 main.go:20 0x47a86c 4883f80a CMPQ AX, $0xa
14 main.go:20 0x47a870 7d1d JGE 0x47a88f
15 main.go:21 0x47a872 e809befbff CALL runtime.printlock(SB)
16 main.go:21 0x47a877 488d0519f50100 LEAQ 0x1f519(IP), AX
17 main.go:21 0x47a87e bb15000000 MOVL $0x15, BX
18 main.go:21 0x47a883 e878c6fbff CALL runtime.printstring(SB)
19 main.go:21 0x47a888 e853befbff CALL runtime.printunlock(SB)
20 main.go:21 0x47a88d eb1b JMP 0x47a8aa
21 main.go:23 0x47a88f e8ecbdfbff CALL runtime.printlock(SB)
22 main.go:23 0x47a894 488d05c8040200 LEAQ 0x204c8(IP), AX
23 main.go:23 0x47a89b bb1a000000 MOVL $0x1a, BX
24 main.go:23 0x47a8a0 e85bc6fbff CALL runtime.printstring(SB)
25 main.go:23 0x47a8a5 e836befbff CALL runtime.printunlock(SB)
26 main.go:25 0x47a8aa 4883c410 ADDQ $0x10, SP
27 main.go:25 0x47a8ae 5d POPQ BP
28 main.go:25 0x47a8af c3 RET
29 main.go:16 0x47a8b0 4883c410 ADDQ $0x10, SP
30 main.go:16 0x47a8b4 5d POPQ BP
31 main.go:16 0x47a8b5 c3 RET
32 main.go:8 0x47a8b6 e845f0feff CALL runtime.morestack_noctxt.abi0(SB)
33 main.go:8 0x47a8bb eb83 JMP main.main(SB)
Using the go tool, it kindly shows which syntax matches which assembly, one by one.
Since what we will learn this time is comparison statements and if branch statements, it is enough to focus on a few lines.
CMPQ Instruction & JL Instruction
The CMPQ instruction is an instruction for comparing 4-byte (4-word) data types, and its etymology is CoMPareQuadword, abbreviated to CMPQ.
Looking at the memory address 0x47a84e, the statement CMPQ os.Args+8(SB), $0x2 is present.
In this case, the program compares the number of arguments it received with the hexadecimal 0x2 (that is, simply 2).
Afterward, through JL, the program performs a jump based on this comparison to check whether the number of arguments is less than 2 (that is, whether the program itself is the only argument). In other words, this is Jump, Less than' abbreviated to JL.
For the preceding comparison, if the number of arguments was less than 2, the program jumps to the address 0x47a8b0, where a JGE is located.
However, the register used in this statement is the AX register, so one must know what value is stored in the register.
MOVQ Instruction
After this, one must understand how the 'CX' register is actually used to store the starting address of the data, and how the actual data is extracted after the address is read.
The range 0x47858-0x47863 shows this operation being performed step by step.
First, the starting address of the argument array is inserted into the CX register with the MOVQ os.Args(SB), CX instruction. At this point, one must understand Go's string type.
A Go string is a struct, and this struct consists of two 8-byte values, making up 16 bytes.
| struct | 8 bytes | 8 bytes |
|---|---|---|
| string | memory address | string length |
Visually, it looks like the above: the first 8 bytes store the starting address of the string, and the latter 8 bytes store the length of the string.
Therefore, the address of the string is stored in the AX register, and the length of the string is stored in the BX register.
CALL
In the previous post as well, when looking at runtime functions, the CALL instruction was attached.
This is attached in front of functions used in Go, and it means that a certain function is called, so it is literally CALL. Afterward, the CALL function is used to convert the string into an integer, and where the integer is stored at this point is abstracted within the function and not visible.
CMPQ Instruction & JGE Instruction
Returning to the earlier address 0x47a86c, the instruction is comparing the address of the string with the number 0xa (decimal 10)!
This means that the program no longer uses that argument, so it overwrote the location of the string to create the slot for the integer variable x.
This is the essence of the aggressive optimization performed in Go and other languages.
Next, the JGE instruction appears, which is an abbreviation of Jump, Greater or Equals. Therefore, this statement asks whether the value is greater than or equal to the comparison target.
Therefore, it is not the x < 10 statement as it is; rather, it is x < 10 with the comparison direction of the statement reversed!
In machine code, skipping ahead preemptively when the condition does not hold is more intuitive than performing the comparison once when the condition holds and then checking again whether it does not hold, and it saves one instruction.
Because this optimization is very classical, it frequently appears even in compilers whose optimization level is considerably low, unlike the strconv.Atoi example seen above, so it is good to know.
Therefore, by applying this idea, one can obtain sources that differ but match 100% at the assembly level.
Mirror Image Code Example
Using the script below, the bash script creates two mirror-image sources with 100% equivalence, and then verifies that, excluding metadata that changes each time, when only main is viewed, exactly identical assembly is obtained.
1#!/usr/bin/env bash
2
3# 1. Completely reset existing leftover files and directories
4echo "[1/6] Cleaning up old artifacts..."
5rm -rf test_dir main_orig main_asm orig.asm asm.asm orig_pure.asm asm_pure.asm
6mkdir -p test_dir
7
8# 2. Write the original source code (main.go)
9echo "[2/6] Generating main.go..."
10cat << 'EOF' > main.go
11package main
12
13import (
14 "os"
15 "strconv"
16)
17
18func main() {
19 if len(os.Args) < 2 {
20 return
21 }
22 x, _ := strconv.Atoi(os.Args[1])
23
24 s1 := "X is smaller than 10"
25 s2 := "X is larger or same as 10"
26
27 if x < 10 {
28 println(s1)
29 } else {
30 println(s2)
31 }
32}
33EOF
34
35# 3. Write the mirror-image source code (main_from_asm.go)
36# Perfectly synchronize the operator structure symmetrically so that the compiler uses the optimization template (JGE) as is
37echo "[3/6] Generating main_from_asm.go..."
38cat << 'EOF' > main_from_asm.go
39package main
40
41import (
42 "os"
43 "strconv"
44)
45
46func main() {
47 if len(os.Args) < 2 {
48 return
49 }
50 x, _ := strconv.Atoi(os.Args[1])
51
52 s1 := "X is smaller than 10"
53 s2 := "X is larger or same as 10"
54
55 // If the x < 10 structure is maintained with 10 as the reference, the compiler
56 // adopts exactly the same JGE mechanism and block layout as main.go.
57 switch {
58 case x < 10:
59 println(s1)
60 default:
61 println(s2)
62 }
63}
64EOF
65
66# 4. Build each in the same directory path and file name environment
67echo "[4/6] Compiling both sources inside 'test_dir'..."
68cp main.go test_dir/main.go
69cd test_dir && go build -o ../main_orig main.go && cd ..
70rm test_dir/main.go
71
72cp main_from_asm.go test_dir/main.go
73cd test_dir && go build -o ../main_asm main.go && cd ..
74
75# 5. Extract the pure main.main assembly function using go tool objdump
76echo "[5/6] Extracting main.main assembly sections..."
77go tool objdump -s "main\.main" main_orig > orig.asm
78go tool objdump -s "main\.main" main_asm > asm.asm
79
80# Remove the virtual addresses, offsets, and machine-code byte data text,
81# and filter only the pure instruction set (Opcode & Operands) fields that the CPU will execute
82awk '{print $4, $5, $6, $7}' orig.asm > orig_pure.asm
83awk '{print $4, $5, $6, $7}' asm.asm > asm_pure.asm
84
85# 6. Verify the two machine instruction structures via diff
86echo "[6/6] Verifying assembly structural integrity via diff..."
87echo "------------------------------------------------------------"
88if diff orig_pure.asm asm_pure.asm > /dev/null; then
89 echo "===> [์ฑ๊ณต] ๋ ๋ฐ์ด๋๋ฆฌ์ main.main ๊ธฐ๊ณ์ด ๋ก์ง์ด 100% ์ผ์นํฉ๋๋ค! <==="
90 echo "์ปดํ์ผ๋ฌ์ ์ต์ ํ ํ์ดํ๋ผ์ธ ๊ฐ์ด๋๋ผ์ธ์ ์๋ฒฝํ๊ฒ ๋๊ธฐํํ์ฌ ๋์ผํ ์ด์
๋ธ๋ฆฌ๋ฅผ ์ป์์ต๋๋ค."
91else
92 echo "===> [์คํจ] ์ด์
๋ธ๋ฆฌ ๋ช
๋ น์ด ๊ตฌ์กฐ์ ์ฐจ์ด์ ์ด ๋ฐ๊ฒฌ๋์์ต๋๋ค. <==="
93 diff -u orig_pure.asm asm_pure.asm
94fi
95echo "------------------------------------------------------------"
When you actually run the source, you can obtain information like the following.
1[1/6] Cleaning up old artifacts...
2[2/6] Generating main.go...
3[3/6] Generating main_from_asm.go...
4[4/6] Compiling both sources inside 'test_dir'...
5[5/6] Extracting main.main assembly sections...
6[6/6] Verifying assembly structural integrity via diff...
7------------------------------------------------------------
8===> [์ฑ๊ณต] ๋ ๋ฐ์ด๋๋ฆฌ์ main.main ๊ธฐ๊ณ์ด ๋ก์ง์ด 100% ์ผ์นํฉ๋๋ค! <===
9์ปดํ์ผ๋ฌ์ ์ต์ ํ ํ์ดํ๋ผ์ธ ๊ฐ์ด๋๋ผ์ธ์ ์๋ฒฝํ๊ฒ ๋๊ธฐํํ์ฌ ๋์ผํ ์ด์
๋ธ๋ฆฌ๋ฅผ ์ป์์ต๋๋ค.
10------------------------------------------------------------
Conclusion
Programming languages provide many abstractions, but behind those abstractions lie very interesting and aggressive optimizations. In addition, by exploiting this point in reverse, we were able to create mirror-image code whose source differs but whose assembly is identical. If you are interested in low-level matters and encounter proprietary software written in Go, it does not seem impossible to disassemble the assembly directly, analyze it, and recover the source.
Next Lecture
In the next session, we will look at the select-case statement, which offers another kind of interest alongside the If statement.