Table of contents:
- Calculating the first 10 elements of the Fibonacci sequence (fib.s)⇒
- Organizing a loop in an assembly program⇒
- Using suffixes in operating codes⇒
- Simple examples of using suffixes⇒
- Simple loop examples
- Listing the first 10 natural numbers⇒
- Listing the first 10 powers of 2⇒
- Listing the first 10 factorials⇒
Calculating the first 10 elements of the Fibonacci sequence (fib.s)
First, let us see a C program that prints the first 10 elements of the Fibonacci sequence.
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad fibonacci.c
command, and create a new file named 'fibonacci.c' with the following content:
#include <stdio.h>
int main() {
int k1, k2, i;
int n=10;
k1=1;
k2=1;
printf("Finonacci numbers\n");
printf("%d\n",k1);
i=2;
while(i<=n) {
printf("%d\n",k2);
int x=k2;
k2=k1+k2;
k1=x;
i++;
}
return 0;
}
Compile, link and run the compiled C program as follows:
Let us now create an equivalent of the 'fibonacci.c' program in Intel x86/x64 assembly language which prints the first 10 elements of the Fibonacci sequence using quadwords length variables.
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad fibonacci.s
command, and create a new file named 'fibonacci.s' with the following content:
.globl main
.data
.P1:
.ascii "Finonacci numbers\12\0"
.P2:
.ascii "%d\12\0"
.text
main:
pushq %rbp
movq %rsp, %rbp
subq $72, %rsp
movq $10, -32(%rbp) # n
movq $1, -8(%rbp) # k1
movq $1, -16(%rbp) # k2
leaq .P1, %rax
movq %rax, %rcx
call printf
movq -8(%rbp), %rax
movq %rax, %rdx
leaq .P2, %rax
movq %rax, %rcx
call printf
movq $2, -24(%rbp) # i
jmp .J2
/* begin loop */
.J1:
movq -16(%rbp), %rax
movq %rax, %rdx
leaq .P2, %rax
movq %rax, %rcx
call printf
movq -16(%rbp), %rax
movq %rax, -40(%rbp) # x
movq -8(%rbp), %rax
addq %rax, -16(%rbp)
movq -40(%rbp), %rax
movq %rax, -8(%rbp)
addq $1, -24(%rbp)
.J2:
movq -24(%rbp), %rax
cmpq -32(%rbp), %rax
jle .J1 # jump if %rax≤-32(%rbp)
/* end of loop */
movq $10, %rax
addq $72, %rsp
popq %rbp
ret
To understand the operation of the loop it is essential to know the status register or flags register⇒ that indicates the current state of an x86/x64 CPU, and especially the status flags (e.g. carry, parity, zero, sign, overflow etc. flags) which usually characterize the result of arithmetic operations.
Note that the return value of the 'main' function was now set to 10 (instead of 0) to see the difference from the compiled fibonacci.c program.
Compile, link and run the assembly program as follows:
Finally, it is very instructive to see the machine code representation of the 'fibonacci.s' assembly program. For that purpose, first compile the program into an object file with debugging information entering the
gcc -g -c fibonacci.s -o fibonacci.o
command, and then create the 'memory dump' of the object file typing the
objdump -d -M -S fibonacci.o
command in the 'cmd' window. We shall get something like this:
The result of the is as follows:
fibonacci.o: file format pe-x86-64
Disassembly of section .text:
0000000000000000 :
0: 55 push %rbp
1: 48 89 e5 mov %rsp,%rbp
4: 48 83 ec 48 sub $0x48,%rsp
8: 48 c7 45 e0 0a 00 00 movq $0xa,-0x20(%rbp)
f: 00
10: 48 c7 45 f8 01 00 00 movq $0x1,-0x8(%rbp)
17: 00
18: 48 c7 45 f0 01 00 00 movq $0x1,-0x10(%rbp)
1f: 00
20: 48 8d 04 25 00 00 00 lea 0x0,%rax
27: 00
28: 48 89 c1 mov %rax,%rcx
2b: e8 00 00 00 00 callq 30
30: 48 8b 45 f8 mov -0x8(%rbp),%rax
34: 48 89 c2 mov %rax,%rdx
37: 48 8d 04 25 13 00 00 lea 0x13,%rax
3e: 00
3f: 48 89 c1 mov %rax,%rcx
42: e8 00 00 00 00 callq 47
47: 48 c7 45 e8 02 00 00 movq $0x2,-0x18(%rbp)
4e: 00
4f: eb 34 jmp 85 <.J2>
0000000000000051 <.J1>:
51: 48 8b 45 f0 mov -0x10(%rbp),%rax
55: 48 89 c2 mov %rax,%rdx
58: 48 8d 04 25 13 00 00 lea 0x13,%rax
5f: 00
60: 48 89 c1 mov %rax,%rcx
63: e8 00 00 00 00 callq 68 <.J1+0x17>
68: 48 8b 45 f0 mov -0x10(%rbp),%rax
6c: 48 89 45 d8 mov %rax,-0x28(%rbp)
70: 48 8b 45 f8 mov -0x8(%rbp),%rax
74: 48 01 45 f0 add %rax,-0x10(%rbp)
78: 48 8b 45 d8 mov -0x28(%rbp),%rax
7c: 48 89 45 f8 mov %rax,-0x8(%rbp)
80: 48 83 45 e8 01 addq $0x1,-0x18(%rbp)
0000000000000085 <.J2>:
85: 48 8b 45 e8 mov -0x18(%rbp),%rax
89: 48 3b 45 e0 cmp -0x20(%rbp),%rax
8d: 7e c2 jle 51 <.J1>
8f: 48 c7 c0 0a 00 00 00 mov $0xa,%rax
96: 48 83 c4 48 add $0x48,%rsp
9a: 5d pop %rbp
9b: c3 retq
9c: 90 nop
9d: 90 nop
9e: 90 nop
9f: 90 nop
In order to organize a loop in an assembly program we need both comparison and control instructions. Let us review some of them via examples:
- cmp %rsi, %rax, cmp $10, %rax or cmp -24(%rbp), %rax (performs a comparison operation between the two operands subtracting the first op from the second; sets the ZF, SF, PF, CF and OF status flags)
- Example 1 (e.g. for pre-tested loops with a loop control variable named 'i'):
- cmpl -12(%rbp), %eax # i>n ?
- jg .L1
- (these instructions compare the data located in the memory address %rbp−12 ('n') with the content of the accumulator ('i'); if the content of the accumulator is greater than 'n', then a conditional jump occurs to the label .L1)
- Example 2 (e.g. for post-tested loops with a loop control variable named 'i'):
- cmpl -12(%rbp), %eax # i<=n ?
- jle .loop
- (these instructions compare the data located in the memory address %rbp−12 ('n') with the content of the accumulator ('i'); if the content of the accumulator is less or equal than 'n', then a conditional jump occurs to the label .loop)
-
test %rax, %rax (sets the ZF, SF and PF status flags; note that this 'test' instruction is equivalent to the
cmp $0, %rax
instruction)
- Example:
- andl $1,%eax # bitwise 'and' operation is performed
- testl %eax,%eax # %eax==0 ?
- jz .cont
- (these instructions test whether the content of the accumulator is even or not; if 'yes', then a conditional jump occurs to the label .cont)
- jmp .J2 (jumps directly to the instruction labelled by .J2 by setting the content of the %rip register)
- je .L1 or jz .L1 (jumps to the instruction labelled by .L1 if ZF equals 1)
- jne .L2 or jnz .L2 (jumps to the instruction labelled by .L2 if ZF is not equal to 1, i.e. ZF equals 0)
- jl .J2 (jumps to the instruction labelled by .J2 if SF is not equal to OF, i.e. the second op of the previous cmp instruction is less than the first op)
- jle .J2 (jumps to the instruction labelled by .J2 if the second op of the previous cmp instruction is less than or equal to the first op)
- jg .J2 (jumps to the instruction labelled by .J2 if the second operand of the previous cmp instruction is greater than the first operand)
- jge .J2 (jumps to the instruction labelled by .J2 if the second op of the previous cmp instruction is greater than or equal to the first op)
Note that after the operating codes of some isntructions we can use certain suffixes to indicate the length of the operands.
| suffix
| length of operands
| example(s)
|
| -b
| byte
| movb $5, -1(%rbp)
movl -1(%rbp), %al
|
| -w
| word
(2 bytes = 16 bits)
| movw $5, -2(%rbp)
movw -2(%rbp), %ax
|
| -l
| doubleword
(4 bytes = 32 bits)
| movl $5, -4(%rbp)
movl -4(%rbp), %eax
|
| -q
| quadword
(8 bytes = 64 bits)
| movq $5, -8(%rbp)
movq -8(%rbp), %rax
leaq pattern, %rcx
|
Note that in the C programming language we can use the following format specifiers of the printf() function:
%hi (for short integers),
%d or %i (for doubleword integers),
%ld (for quadword integers).
Simple examples of using suffixes
(1) Using signed bytes (or characters):
.globl main
.data
pattern:
.ascii "a=%hi, b=%hi, a+b=%hi\12\0"
.text
main:
pushq %rbp
movq %rsp, %rbp
subq $48, %rsp
movb $5, -1(%rbp) # a
movb $-8, -2(%rbp) # b
movb -1(%rbp), %al
addb -2(%rbp), %al
cbtw
movw %ax, %r9w # a+b
movb -1(%rbp), %al
cbtw
movw %ax, %dx # a
movb -2(%rbp), %al
cbtw
movw %ax, %r8w # b
leaq pattern, %rcx
call printf
movq $0, %rax
addq $48, %rsp
popq %rbp
ret
Note that the assembly instruction cbtw converts the 'al' register containing a signed 8-bit integer value to the word-length 'ax' register.
(2) Using short integers:
.globl main
.data
pattern:
.ascii "a=%hi, b=%hi, a+b=%hi\12\0"
.text
main:
pushq %rbp
movq %rsp, %rbp
subq $48, %rsp
movw $5, -2(%rbp) # a
movw $-8, -4(%rbp) # b
movw -2(%rbp), %ax
addw -4(%rbp), %ax
movw -2(%rbp), %dx # a
movw -4(%rbp), %r8w # b
movw %ax, %r9w # a+b
leaq pattern, %rcx
call printf
movq $0, %rax
addq $48, %rsp
popq %rbp
ret
(3) Using doubleword integers:
.globl main
.data
pattern:
.ascii "a=%d, b=%d, a+b=%d\12\0"
.text
main:
pushq %rbp
movq %rsp, %rbp
subq $48, %rsp
movl $5, -4(%rbp) # a
movl $-8, -8(%rbp) # b
movl -4(%rbp), %eax
addl -8(%rbp), %eax
movl -4(%rbp), %edx # a
movl -8(%rbp), %r8d # b
movl %eax, %r9d # a+b
leaq pattern, %rcx
call printf
movl $0, %eax
addq $48, %rsp
popq %rbp
ret
(4) Using quadword integers:
.globl main
.data
pattern:
.ascii "a=%ld, b=%ld, a+b=%ld\12\0"
.text
main:
pushq %rbp
movq %rsp, %rbp
subq $48, %rsp
movq $5, -8(%rbp) # a
movq $-8, -16(%rbp) # b
movq -8(%rbp), %rax
addq -16(%rbp), %rax
movq -8(%rbp), %rdx # a
movq -16(%rbp), %r8 # b
movq %rax, %r9 # a+b
leaq pattern, %rcx
call printf
movq $0, %rax
addq $48, %rsp
popq %rbp
ret
It is important to study very carefully in the simple examples presented above the correct use of suffixes for the assembly instructions as well as the format specifiers used in the printf() function.
Listing the first 10 natural numbers
First, let us see a C program that prints the first 10 natural numbers (starting with 1, then 2, 3, 4, ..., 10).
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad natural.c
command, and create a new file named 'natural.c' with the following content:
#include <stdio.h>
int main() {
int x=1;
int i, n=10;
for(i=1;i<=n;i++) {
printf("%d\n",x);
x++;
}
return i;
}
Compile, link and run the compiled C program as follows:
Now it can be very instructive to see the compiled assembly version of the C program. Type and run in the 'cmd' window the
gcc natural.c -S -o nat.s
command. After making some changes (omitting some parts, commenting some of the instructions etc.), the resulting file will look like something like this:
.data
.pattern:
.ascii "%d\12\0"
.text
printf:
pushq %rbp
pushq %rbx # callee saved
subq $56, %rsp
leaq 48(%rsp), %rbp
/* 56=48+8; pushing %rbx allocates +8 bytes at the stack⇒ */
movq %rcx, 32(%rbp) # 4th argument stored
movq %rdx, 40(%rbp) # 3rd argument stored
movq %r8, 48(%rbp) # 5th argument stored
movq %r9, 56(%rbp) # 6th argument stored
leaq 40(%rbp), %rax
movq %rax, -16(%rbp) # local variable
movq -16(%rbp), %rbx
movl $1, %ecx
movq __imp___acrt_iob_func(%rip), %rax
call *%rax
movq %rax, %rcx
movq 32(%rbp), %rax
movq %rbx, %r8
movq %rax, %rdx
call __mingw_vfprintf
movl %eax, -4(%rbp)
movl -4(%rbp), %eax
addq $56, %rsp
popq %rbx
popq %rbp
ret
.text
.globl main
main:
pushq %rbp
movq %rsp, %rbp
subq $48, %rsp # stack frame (48 byte)
call __main
movl $1, -4(%rbp) # variable x
movl $10, -12(%rbp) # variable n
movl $1, -8(%rbp) # variable i
jmp .L4
/* begin of loop */
.L5:
movl -4(%rbp), %eax # variable x to print
movl %eax, %edx # 3rd parameter for printf
leaq .pattern, %rax # address of .pattern
movq %rax, %rcx # 4th parameter for printf
call printf
addl $1, -4(%rbp) # x++
addl $1, -8(%rbp) # i++
.L4:
movl -8(%rbp), %eax # i → %eax
cmpl -12(%rbp), %eax # %eax≤-12(%rbp) ?
// -12(%rbp) is a reference to variable n
jle .L5 # jump if i≤n
/* end of loop */
movl -8(%rbp), %eax
addq $48, %rsp
popq %rbp
ret
Before the 'printf' function is called and the local variables are "declared" (i.e. before the 'jmp .L4' instruction), the content of the stack frame created by the 'main' function is as follows:
| address
| content
|
| 0(%rsp)
| -48(%rbp)
|
allocated space for the four parameters (or arguments) for the function 'printf'
|
| 8(%rsp)
| -40(%rbp)
|
| 16(%rsp)
| -32(%rbp)
|
| 24(%rsp)
| -24(%rbp)
|
|
|
| (not used)
|
|
| -12(%rbp)
| variable n (initially n=10)
|
|
| -8(%rbp)
| variable i (initially i=1)
|
|
| -4(%rbp)
| variable x (initially x=1)
|
| 48(%rsp)
| 0(%rbp)
| previous value of %rbp (pushed by the first instruction of main)
|
|
| 8(%rbp)
| return address for the caller of 'main' (for 'ret' in main)
|
After the 'printf' function is called for the first time by the 'main' function, the content of the stack frame created by the 'printf' function is as follows:
| address
| content
|
| 0(%rsp)
| -48(%rbp)
|
|
| ...
| ...
| ...
|
| 48(%rsp)
| 0(%rbp)
|
|
| 56(%rsp)
| 8(%rbp)
| previous value of %rbx (pushed by the second instruction of printf)
|
|
| 16(%rbp)
| previous value of %rbp (pushed by the first instruction of printf)
|
|
| 24(%rbp)
| return address for the caller of 'printf', i.e. the address of the next instruction of 'main' after the 'call printf' instruction
|
|
(the following part of the stack is the same space for the arguments (or parameters) of the 'printf' function that has been allocated by the 'main' function, see the top of its stack frame in the table above)
|
|
| 32(%rbp)
| 4th argument of the function 'printf'
|
|
| 40(%rbp)
| 3rd argument of the function 'printf'
|
|
| 48(%rbp)
| 5th argument of the function 'printf'
|
|
| 56(%rbp)
| 6th argument of the function 'printf'
|
Let us now create an equivalent of the 'natural.c' program in Intel x86/x64 assembly language which prints the first 10 natural numbers.
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad natural.s
command, and create a new file named 'natural.s' with the following content:
.globl main
.data
msg:
.ascii "The first %d natural numbers:\12\0"
pattern:
.ascii "%d\12\0"
.text
main:
pushq %rbp
movq %rsp, %rbp
subq $48, %rsp
movl $1, -4(%rbp) # x
movl $10, -12(%rbp) # n
movl $1, -8(%rbp) # i
leaq msg, %rcx
movl -12(%rbp), %edx
call printf
.L0:
movl -8(%rbp), %eax
cmpl -12(%rbp), %eax # i>n ?
jg .L1
leaq pattern, %rcx
movl -4(%rbp), %edx
call printf
incl -4(%rbp)
incl -8(%rbp)
jmp .L0
.L1:
movl -8(%rbp), %eax
addq $48, %rsp
popq %rbp
ret
Compile, link and run the assembly program as follows:
Listing the first 10 powers of 2
First, let us see a C program that prints the first 10 powers of 2 (starting with 1, then 2, 4, 8 etc.).
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad powers.c
command, and create a new file named 'powers.c' with the following content:
#include <stdio.h>
int nextpow(int x) {
int p=x+x;
return p;
}
int main() {
int x=1;
int i=1, n=10;
do {
printf("%d\n",x);
x=nextpow(x);
i++;
} while(i<=n);
return i;
}
Compile, link and run the compiled C program as follows:
Let us now create an equivalent of the 'powers.c' program in Intel x86/x64 assembly language which prints the first 10 powers of 2.
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad powers.s
command, and create a new file named 'powers.s' with the following content:
.globl main
.data
pattern:
.ascii "%d\12\0"
.text
nextpow:
pushq %rbp
movq %rsp, %rbp
subq $16, %rsp # stack frame size
movl %ecx, 16(%rbp) # parameter x
movl 16(%rbp), %eax
addl %eax, %eax
movl %eax, -4(%rbp) # local variable p
movl -4(%rbp), %eax
addq $16, %rsp
popq %rbp
ret
main:
pushq %rbp
movq %rsp, %rbp
subq $48, %rsp
movl $1, -4(%rbp) # variable x
movl $1, -8(%rbp) # variable i
movl $10, -12(%rbp) # variable n
.loop:
movl -4(%rbp), %edx
leaq pattern, %rcx
call printf
movl -4(%rbp), %ecx
call nextpow
movl %eax, -4(%rbp)
addl $1, -8(%rbp) # i++
movl -8(%rbp), %eax
cmpl -12(%rbp), %eax # i<=n ?
jle .loop
movl -8(%rbp), %eax
addq $48, %rsp
popq %rbp
ret
Compile, link and run the assembly program as follows:
Listing the first 10 factorials
First, let us see a C program that prints the first 10 factorials (starting with 1, then 2, 6, 24 etc.).
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad fact.c
command, and create a new file named 'fact.c' with the following content:
#include <stdio.h>
int f(int n) {
int temp;
temp=1;
for(int i=2;i<=n;i++) {
temp=temp*i;
}
return temp;
}
int main() {
int n=10;
printf("List of the first %d factorials:\n",n);
int i=1;
while(i<=n) {
printf("%d\n",f(i));
i=i+1;
};
return i;
}
Compile, link and run the compiled C program as follows:
Let us now create an equivalent of the 'fact.c' program in Intel x86/x64 assembly language which prints the first 10 factorials.
Open a new 'cmd' window in the c:\temp\gcc directory, run the
notepad fact.s
command, and create a new file named 'fact.s' with the following content:
.globl main
.globl f
.data
.LC0:
.ascii "List of the first %d factorials:\12\0"
.LC1:
.ascii "%d\12\0"
.text
f:
pushq %rbp
movq %rsp, %rbp
subq $16, %rsp
movl %ecx, 16(%rbp)
movl $1, -4(%rbp)
movl $2, -8(%rbp)
jmp .L4
.L5:
movl -4(%rbp), %eax
imull -8(%rbp), %eax
movl %eax, -4(%rbp)
addl $1, -8(%rbp)
.L4:
movl -8(%rbp), %eax
cmpl 16(%rbp), %eax
jle .L5
movl -4(%rbp), %eax
addq $16, %rsp
popq %rbp
ret
main:
pushq %rbp
movq %rsp, %rbp
subq $48, %rsp
movl $10, -8(%rbp)
movl -8(%rbp), %eax
movl %eax, %edx
leaq .LC0, %rax
movq %rax, %rcx
call printf
movl $1, -4(%rbp)
jmp .L8
.L9:
movl -4(%rbp), %eax
movl %eax, %ecx
call f
movl %eax, %edx
leaq .LC1, %rax
movq %rax, %rcx
call printf
addl $1, -4(%rbp)
.L8:
movl -4(%rbp), %eax
cmpl -8(%rbp), %eax
jle .L9
movl -4(%rbp), %eax
addq $48, %rsp
popq %rbp
ret
Note that the imul assembly instruction executes a signed multiplication or product of the first operand (which can be either a register or a word-length or doubleword-length memory content) and the second operand (a register), and stores the resulting product in the the register specified as the second operand.
Compile, link and run the assembly program as follows:
Its main purpose is to execute the machine-level instructions of programs.
.)
),
