GoSudaAnalyse af AMD64-assemblerkodegenerering og forgreningsinstruktioner for Go-betingelsessætninger (if)
If-statements in the Go Language
First, the reason we chose Go is that, among modern languages, Go has perhaps the most "beautiful" assembly, and its syntactic efficiency is sometimes overwhelming even when compared with classical languages.
Now that we have understood how a simple Go program behaves in the previous lecture, let us compare Go and Assembly line by line.
Source Code
First of all, as is true of Go, modern compilers including GCC automatically optimize branch statements that serve no purpose. Even C compilers such as GCC and Clang perform very aggressive optimizations at -O2, the industry standard; thus the era in which programmers could hardly trust compilers fully was, in fact, concluded in the late 20th century.
Therefore, from the compiler's perspective, a condition must be one that is difficult to predict and rewrite into a different construct in order for the branch to be meaningful at all.
1package main
2
3import (
4 "os"
5 "strconv"
6)
7
8func main() {
9 // 만약 이것을 x = 10과 같은 예측 가능하며 분기를 지울 수 있는 것으로 때우면
10 // 컴파일러가 최적화하여서 분기를 지운다.
11 // 따라서 이런 것을 직접 어셈블리로 구경하려면 C언어에서는 -O0 등을 두거나
12 // 애초에 컴파일러가 예측 불가한 외부 값을 쓰게 하는데,
13 // 이 섹션은 모던 프로그래밍을 다루니 Go의 바이너리 최적화를
14 // 끄는 방식은 사용하지 않는다.
15 if len(os.Args) < 2 {
16 return
17 }
18 x, _ := strconv.Atoi(os.Args[1])
19
20 if x < 10 {
21 println("X is smaller than 10")
22 } else {
23 println("X is larger or same as 10")
24 }
25}
In this case, because the compiler cannot predict the input, the branch is translated into machine code as it is.
Assembly Language
1TEXT main.main(SB) /home/yjlee/introduction-to-golang/learn-golang/if-and-switch/golang-if/main.go
2 main.go:8 0x47a840 493b6610 CMPQ SP, 0x10(R14)
3 main.go:8 0x47a844 7670 JBE 0x47a8b6
4 main.go:8 0x47a846 55 PUSHQ BP
5 main.go:8 0x47a847 4889e5 MOVQ SP, BP
6 main.go:8 0x47a84a 4883ec10 SUBQ $0x10, SP
7 main.go:15 0x47a84e 48833d12fb0a0002 CMPQ os.Args+8(SB), $0x2
8 main.go:15 0x47a856 7c58 JL 0x47a8b0
9 main.go:15 0x47a858 488b0d01fb0a00 MOVQ os.Args(SB), CX
10 main.go:18 0x47a85f 488b4110 MOVQ 0x10(CX), AX
11 main.go:18 0x47a863 488b5918 MOVQ 0x18(CX), BX
12 main.go:18 0x47a867 e834e8ffff CALL strconv.Atoi(SB)
13 main.go:20 0x47a86c 4883f80a CMPQ AX, $0xa
14 main.go:20 0x47a870 7d1d JGE 0x47a88f
15 main.go:21 0x47a872 e809befbff CALL runtime.printlock(SB)
16 main.go:21 0x47a877 488d0519f50100 LEAQ 0x1f519(IP), AX
17 main.go:21 0x47a87e bb15000000 MOVL $0x15, BX
18 main.go:21 0x47a883 e878c6fbff CALL runtime.printstring(SB)
19 main.go:21 0x47a888 e853befbff CALL runtime.printunlock(SB)
20 main.go:21 0x47a88d eb1b JMP 0x47a8aa
21 main.go:23 0x47a88f e8ecbdfbff CALL runtime.printlock(SB)
22 main.go:23 0x47a894 488d05c8040200 LEAQ 0x204c8(IP), AX
23 main.go:23 0x47a89b bb1a000000 MOVL $0x1a, BX
24 main.go:23 0x47a8a0 e85bc6fbff CALL runtime.printstring(SB)
25 main.go:23 0x47a8a5 e836befbff CALL runtime.printunlock(SB)
26 main.go:25 0x47a8aa 4883c410 ADDQ $0x10, SP
27 main.go:25 0x47a8ae 5d POPQ BP
28 main.go:25 0x47a8af c3 RET
29 main.go:16 0x47a8b0 4883c410 ADDQ $0x10, SP
30 main.go:16 0x47a8b4 5d POPQ BP
31 main.go:16 0x47a8b5 c3 RET
32 main.go:8 0x47a8b6 e845f0feff CALL runtime.morestack_noctxt.abi0(SB)
33 main.go:8 0x47a8bb eb83 JMP main.main(SB)
The go tool conveniently shows which source statement corresponds to which assembly instruction, one by one.
Since what we will learn this time is the comparison and the if branch statement, it is enough to focus on a few lines.
CMPQ Instruction & JL Instruction
The CMPQ instruction is an instruction for comparing 4-byte (4-word) data types, and its etymology is CoMPareQuadword, abbreviated to CMPQ.
Looking at the memory address 0x47a84e, the statement CMPQ os.Args+8(SB), $0x2 is present.
In this case, the program compares the number of input arguments with the hexadecimal 0x2 (that is, simply 2).
Afterwards, whether the number of arguments is less than 2 (that is, whether the program itself is the only argument) is checked, and a comparison-based jump is performed via JL. That is, this is abbreviated JL from Jump, Less than.
If the argument count was less than 2 from the preceding comparison, the program jumps to address 0x47a8b0, where a JGE appears.
However, since the register used in this statement is AX, one must know what value is stored in the register.
MOVQ Instruction
Next, one must understand how the start address of the data is actually stored using the 'CX' register, and how the actual data is extracted after reading the address.
Looking at the range 0x47858-0x47863, this operation is performed step by step.
First, the start address of the argument array is inserted into the CX register by the MOVQ os.Args(SB), CX instruction. At this point, one must understand Go's string type.
Go's string is a structure, and this structure consists of 16 bytes made of two 8-byte data items.
| struct | 8 byte | 8 byte |
|---|---|---|
| string | mem address | string length |
Visually, it is drawn as above: the first 8 bytes store the starting address of the string, and the latter 8 bytes store the length of the string.
Therefore, the address of the string is stored in the AX register, and the length of the string is stored in the BX register.
CALL
In the previous post, when we looked at runtime functions, the instruction CALL was attached to them as well.
This is attached in front of functions used in Go, and it literally means CALL, indicating that a certain function is called. Afterwards, the string is converted into an integer using a CALL function, but where the integer is stored at this point is not visible, being abstracted away within the function.
CMPQ Instruction & JGE Instruction
Returning to the earlier address 0x47a86c, the instruction is comparing the string's address with the number 0xa (decimal 10)!
This means that, since the program no longer uses that argument, it overwrote the position of the string to create the slot for the integer variable x.
This is the true nature of the aggressive optimization performed in languages such as Go.
Next, the instruction JGE appears, which is an abbreviation of Jump, Greater or Equals. Accordingly, this instruction asks whether the value is greater than or equal to the comparison target.
Accordingly, it is not exactly the statement x < 10, but the comparison direction of the statement is reversed relative to x < 10!
This is because, at the machine-code level, skipping ahead preemptively when the condition does not hold is more intuitive than performing the comparison once when the condition holds and then checking again whether it does not hold, and it saves one instruction.
Because this optimization is very classic, it is a pattern that frequently appears even in compilers with fairly low optimization levels, unlike the strconv.Atoi example seen above, so it is good to know.
Therefore, by applying this point, one can obtain source code that differs in text but matches 100% at the assembly level.
Mirror Image Code Example
If you use the script below, the Bash script generates two mirror-image sources at 100%, and, excluding metadata that changes each time, you can verify that exactly identical assembly is obtained when looking only at main.
1#!/usr/bin/env bash
2
3# 1. 기존 잔여 파일 및 디렉터리 완전 초기화
4echo "[1/6] Cleaning up old artifacts..."
5rm -rf test_dir main_orig main_asm orig.asm asm.asm orig_pure.asm asm_pure.asm
6mkdir -p test_dir
7
8# 2. 원래 버전 소스 코드 작성 (main.go)
9echo "[2/6] Generating main.go..."
10cat << 'EOF' > main.go
11package main
12
13import (
14 "os"
15 "strconv"
16)
17
18func main() {
19 if len(os.Args) < 2 {
20 return
21 }
22 x, _ := strconv.Atoi(os.Args[1])
23
24 s1 := "X is smaller than 10"
25 s2 := "X is larger or same as 10"
26
27 if x < 10 {
28 println(s1)
29 } else {
30 println(s2)
31 }
32}
33EOF
34
35# 3. 거울상 버전 소스 코드 작성 (main_from_asm.go)
36# 컴파일러가 최적화 템플릿(JGE)을 그대로 쓰도록 연산자 구조를 완벽히 대칭 동기화
37echo "[3/6] Generating main_from_asm.go..."
38cat << 'EOF' > main_from_asm.go
39package main
40
41import (
42 "os"
43 "strconv"
44)
45
46func main() {
47 if len(os.Args) < 2 {
48 return
49 }
50 x, _ := strconv.Atoi(os.Args[1])
51
52 s1 := "X is smaller than 10"
53 s2 := "X is larger or same as 10"
54
55 // 10를 기준으로 삼아 x < 10 구조를 유지하면 컴파일러는
56 // main.go와 정확히 동일한 JGE 매커니즘 및 블록 배치를 채택합니다.
57 if x < 10 {
58 println(s1)
59 } else {
60 println(s2)
61 }
62}
63EOF
64
65# 4. 동일한 디렉터리 경로 및 파일명 환경에서 각각 빌드 수행
66echo "[4/6] Compiling both sources inside 'test_dir'..."
67cp main.go test_dir/main.go
68cd test_dir && go build -o ../main_orig main.go && cd ..
69
70rm test_dir/main.go
71cp main_from_asm.go test_dir/main.go
72cd test_dir && go build -o ../main_asm main.go && cd ..
73
74# 5. go tool objdump를 사용하여 순수 main.main 어셈블리 함수 추출
75echo "[5/6] Extracting main.main assembly sections..."
76go tool objdump -s "main\.main" main_orig > orig.asm
77go tool objdump -s "main\.main" main_asm > asm.asm
78
79# 가상 주소, 오프셋, 기계어 바이티 데이터 텍스트를 제거하고
80# CPU가 실행할 순수 명령어 셋(Opcode & Operands) 필드만 필터링
81awk '{print $4, $5, $6, $7}' orig.asm > orig_pure.asm
82awk '{print $4, $5, $6, $7}' asm.asm > asm_pure.asm
83
84# 6. 두 기계어 명령어 구조 diff 검증
85echo "[6/6] Verifying assembly structural integrity via diff..."
86echo "------------------------------------------------------------"
87
88if diff orig_pure.asm asm_pure.asm > /dev/null; then
89 echo "===> [성공] 두 바이너리의 main.main 기계어 로직이 100% 일치합니다! <==="
90 echo "컴파일러의 최적화 파이프라인 가이드라인을 완벽하게 동기화하여 동일한 어셈블리를 얻었습니다."
91else
92 echo "===> [실패] 어셈블리 명령어 구조에 차이점이 발견되었습니다. <==="
93 diff -u orig_pure.asm asm_pure.asm
94fi
95echo "------------------------------------------------------------"
When you actually run the source, you can obtain information like the following.
1[1/6] Cleaning up old artifacts...
2[2/6] Generating main.go...
3[3/6] Generating main_from_asm.go...
4[4/6] Compiling both sources inside 'test_dir'...
5[5/6] Extracting main.main assembly sections...
6[6/6] Verifying assembly structural integrity via diff...
7------------------------------------------------------------
8===> [성공] 두 바이너리의 main.main 기계어 로직이 100% 일치합니다! <===
9컴파일러의 최적화 파이프라인 가이드라인을 완벽하게 동기화하여 동일한 어셈블리를 얻었습니다.
10------------------------------------------------------------
Conclusion
Programming languages provide many abstractions, but behind those abstractions lie very interesting and aggressive optimizations. Moreover, by exploiting this fact in reverse, we were able to create mirror-image code whose source differs but whose assembly is identical. If you are interested in low-level matters and encounter proprietary software written in Go, it does not seem impossible to disassemble its assembly directly and analyze it to recover the source.
Next Lecture
In the next session, we will look at the select-case statement, which, together with the if statement, offers another area of interest.