--- id: 04e03e046bb46ab34aaeeed79279923b author: Lee Yunjin title: Analisis Pembuatan Kode Assembly AMD64 untuk Pernyataan Kondisional (if) pada Go dan Instruksi Percabangan description: Compiler Go menerjemahkan pernyataan kondisional if-else ke dalam instruksi percabangan mesin AMD64 seperti CMPQ, JGE, dan JMP, dan hasil tersebut dibandingkan dengan hasil pembangkitan kode percabangan dari compiler C (-O2). language: id date: 2026-05-17T12:00:00Z path: /blog/posts/go-if-statement-analysis-3012d30c category: lowlevel --- ## If Statements in the Go Language First, the reason we chose Go is that among modern languages, Go has the most "beautiful" assembly, and its syntactic efficiency is sometimes overwhelming even when compared with classical languages. Now that we have understood how a simple Go program behaves in the previous lecture, let us compare Go and Assembly line by line. ### Source Code First, as with Go, modern compilers including GCC automatically optimize branch statements that serve no purpose. C compilers such as GCC and Clang also perform very aggressive optimizations at -O2, the industry standard, so the era in which programmers could hardly trust compilers fully was, in effect, already concluded in the late 20th century. Therefore, from the compiler's perspective, the conditions must be ones that are difficult to predict and rewrite into other constructs; only then do they carry any meaning. ```go package main import ( "os" "strconv" ) func main() { // If this is replaced with something predictable and removable, such as x = 10, // the compiler optimizes it and removes the branch. // Therefore, to view such code directly as assembly, one would use -O0 or similar in C, // or make the compiler use an unpredictable external value from the start, // but since this section deals with modern programming, the method of // disabling Go's binary optimization is not used. if len(os.Args) < 2 { return } x, _ := strconv.Atoi(os.Args[1]) if x < 10 { println("X is smaller than 10") } else { println("X is larger or same as 10") } } ``` In this case, since the compiler cannot predict the input, the branch statement is translated into machine code as is. ### Assembly Language ```asm TEXT main.main(SB) /home/yjlee/introduction-to-golang/learn-golang/if-and-switch/golang-if/main.go main.go:8 0x47a840 493b6610 CMPQ SP, 0x10(R14) main.go:8 0x47a844 7670 JBE 0x47a8b6 main.go:8 0x47a846 55 PUSHQ BP main.go:8 0x47a847 4889e5 MOVQ SP, BP main.go:8 0x47a84a 4883ec10 SUBQ $0x10, SP main.go:15 0x47a84e 48833d12fb0a0002 CMPQ os.Args+8(SB), $0x2 main.go:15 0x47a856 7c58 JL 0x47a8b0 main.go:15 0x47a858 488b0d01fb0a00 MOVQ os.Args(SB), CX main.go:18 0x47a85f 488b4110 MOVQ 0x10(CX), AX main.go:18 0x47a863 488b5918 MOVQ 0x18(CX), BX main.go:18 0x47a867 e834e8ffff CALL strconv.Atoi(SB) main.go:20 0x47a86c 4883f80a CMPQ AX, $0xa main.go:20 0x47a870 7d1d JGE 0x47a88f main.go:21 0x47a872 e809befbff CALL runtime.printlock(SB) main.go:21 0x47a877 488d0519f50100 LEAQ 0x1f519(IP), AX main.go:21 0x47a87e bb15000000 MOVL $0x15, BX main.go:21 0x47a883 e878c6fbff CALL runtime.printstring(SB) main.go:21 0x47a888 e853befbff CALL runtime.printunlock(SB) main.go:21 0x47a88d eb1b JMP 0x47a8aa main.go:23 0x47a88f e8ecbdfbff CALL runtime.printlock(SB) main.go:23 0x47a894 488d05c8040200 LEAQ 0x204c8(IP), AX main.go:23 0x47a89b bb1a000000 MOVL $0x1a, BX main.go:23 0x47a8a0 e85bc6fbff CALL runtime.printstring(SB) main.go:23 0x47a8a5 e836befbff CALL runtime.printunlock(SB) main.go:25 0x47a8aa 4883c410 ADDQ $0x10, SP main.go:25 0x47a8ae 5d POPQ BP main.go:25 0x47a8af c3 RET main.go:16 0x47a8b0 4883c410 ADDQ $0x10, SP main.go:16 0x47a8b4 5d POPQ BP main.go:16 0x47a8b5 c3 RET main.go:8 0x47a8b6 e845f0feff CALL runtime.morestack_noctxt.abi0(SB) main.go:8 0x47a8bb eb83 JMP main.main(SB) ``` When using the go tool, it kindly shows which statement matches which assembly instruction, one by one. Since what we will learn this time is comparison and the if branch statement, it suffices to focus on a few lines. ### CMPQ Instruction and JL Instruction The `CMPQ` instruction is an instruction for comparing 4-byte (4-word) data types, and its etymology is **C**o**MP**are**Q**uadword, abbreviated as **CMPQ**. Looking at the memory address `0x47a84e`, the statement `CMPQ os.Args+8(SB), $0x2` is present. In this case, the program compares the number of input arguments with the hexadecimal `0x2` (that is, simply 2). Afterwards, to check whether the number of arguments is less than 2 (that is, if the program itself is the only argument), it performs a conditional jump via `JL`. That is, this is short for **J**ump, **L**ess than, giving **JL**. If the argument count was less than 2 from the preceding comparison, it jumps to address `0x47a8b0`, where there is a `JGE`. However, since the register used in this statement is the `AX` register, one must know what value is stored in the register. ### MOVQ Instruction Next, one must understand how the start address of the data is actually stored using the 'CX' register, and how the actual data is extracted after reading the address. Looking at the range `0x47858`-`0x47863`, this operation is performed step by step. First, the start address of the argument array is inserted into the CX register with the `MOVQ os.Args(SB), CX` instruction. At this point, one must understand the string type of Go. A Go `string` is a structure, and this structure consists of 16 bytes made of two 8-byte data items. | struct | 8 byte | 8 byte | | ------ | ----------- | ------------- | | string | mem address | string length | Visually, it is drawn as above: the first 8 bytes store the start address of the string, and the latter 8 bytes store the length of the string. Therefore, the address of the string is stored in the AX register, and the length of the string is stored in the BX register. ### CALL In the previous post as well, when looking at `runtime` functions, the instruction CALL was attached. This is attached in front of functions used in Go, and it means **calling** a certain function, which is literally CALL. Afterwards, the string is converted into an integer using a CALL function, but where the integer is stored is **not visible, being abstracted within the function.** ### CMPQ Instruction and JGE Instruction Returning to the earlier address `0x47a86c`, the instruction **compares the address of the string with the number `0xa` (decimal 10)!** This means that, since the program no longer uses that argument, **the string's location was overwritten to create the space for the integer variable `x`.** This is the essence of aggressive optimization performed in languages such as Go. Next, the JGE instruction appears, which is an abbreviation of **J**ump, **G**reater or **E**quals. Therefore, this statement asks whether the value is greater than or equal to the comparison target. Accordingly, it is not exactly the statement `x < 10`; the **comparison direction of the statement is reversed to `x < 10`!** In machine code, skipping ahead preemptively when the condition does not match is more intuitive than performing the comparison once when the condition matches and then checking again whether it does not match, and it **saves one instruction**. Because this optimization is very classical, it frequently appears even in compilers with fairly low optimization levels, unlike the `strconv.Atoi` example seen above, so it is worth knowing. Therefore, by applying this point, one can obtain source code that differs in form but matches **100%** at the assembly level. ### Mirror Image Code Example Using the script below, the Bash script creates two mirror-image sources at 100%, and after excluding the metadata that varies each time, it can be verified that exactly identical assembly is obtained when looking only at `main`. ```bash #!/usr/bin/env bash # 1. Completely reset existing leftover files and directories echo "[1/6] Cleaning up old artifacts..." rm -rf test_dir main_orig main_asm orig.asm asm.asm orig_pure.asm asm_pure.asm mkdir -p test_dir # 2. Write the original source code (main.go) echo "[2/6] Generating main.go..." cat << 'EOF' > main.go package main import ( "os" "strconv" ) func main() { if len(os.Args) < 2 { return } x, _ := strconv.Atoi(os.Args[1]) s1 := "X is smaller than 10" s2 := "X is larger or same as 10" if x < 10 { println(s1) } else { println(s2) } } EOF # 3. Write the mirror-image source code (main_from_asm.go) # Perfectly symmetrize the operator structure so the compiler adopts the optimization template (JGE) as is echo "[3/6] Generating main_from_asm.go..." cat << 'EOF' > main_from_asm.go package main import ( "os" "strconv" ) func main() { if len(os.Args) < 2 { return } x, _ := strconv.Atoi(os.Args[1]) s1 := "X is smaller than 10" s2 := "X is larger or same as 10" // Using 10 as the reference and keeping the x < 10 structure, the compiler // adopts exactly the same JGE mechanism and block layout as main.go. switch { case x < 10: println(s1) default: println(s2) } } EOF # 4. Build both sources in the same directory path and file name environment echo "[4/6] Compiling both sources inside 'test_dir'..." cp main.go test_dir/main.go cd test_dir && go build -o ../main_orig main.go && cd .. rm test_dir/main.go cp main_from_asm.go test_dir/main.go cd test_dir && go build -o ../main_asm main.go && cd .. # 5. Extract the pure main.main assembly function using go tool objdump echo "[5/6] Extracting main.main assembly sections..." go tool objdump -s "main\.main" main_orig > orig.asm go tool objdump -s "main\.main" main_asm > asm.asm # Remove the virtual address, offset, and machine byte data text, # and filter only the pure instruction set (Opcode & Operands) fields the CPU executes awk '{print $4, $5, $6, $7}' orig.asm > orig_pure.asm awk '{print $4, $5, $6, $7}' asm.asm > asm_pure.asm # 6. Verify the structural diff of the two machine instruction sets echo "[6/6] Verifying assembly structural integrity via diff..." echo "------------------------------------------------------------" if diff orig_pure.asm asm_pure.asm > /dev/null; then echo "===> [성공] 두 바이너리의 main.main 기계어 로직이 100% 일치합니다! <===" echo "컴파일러의 최적화 파이프라인 가이드라인을 완벽하게 동기화하여 동일한 어셈블리를 얻었습니다." else echo "===> [실패] 어셈블리 명령어 구조에 차이점이 발견되었습니다. <===" diff -u orig_pure.asm asm_pure.asm fi echo "------------------------------------------------------------" ``` When you actually run the source, you can obtain information such as the following. ```text [1/6] Cleaning up old artifacts... [2/6] Generating main.go... [3/6] Generating main_from_asm.go... [4/6] Compiling both sources inside 'test_dir'... [5/6] Extracting main.main assembly sections... [6/6] Verifying assembly structural integrity via diff... ------------------------------------------------------------ ===> [성공] 두 바이너리의 main.main 기계어 로직이 100% 일치합니다! <=== 컴파일러의 최적화 파이프라인 가이드라인을 완벽하게 동기화하여 동일한 어셈블리를 얻었습니다. ------------------------------------------------------------ ``` ### Conclusion Programming languages provide many abstractions, but behind those abstractions one can see that very interesting and aggressive optimizations are hidden. Also, by exploiting this point in reverse, it was possible to create mirror-image code whose source differs but whose assembly is identical. If you are interested in low-level details and encounter proprietary software written in Go, it does not seem impossible to disassemble the assembly directly and analyze it to recover the source. ## Next Lecture In the next session, we will look at the `select-case` statement, which is another interesting topic alongside the If statement.