Why does assembly code differ depending on the disassembler I use? - c++

Question

I am teaching myself to debug assembly language; I am new to assembly. I have a very simple C++ program and I disassembled it 3 times using different disassemblers: GDB, otool, and godbolt.org. GDB and godbolt.org produced approximately the same amount of code (1 page in a word processor), though many lines differ. The otool -tv command produced about 14 pages of code so there are many differences with respect to the GDB and godbolt.org outputs. The assembly code is too long to post. I was expecting the assembly code outputs to be the same as each other. Why are they different and which disassembler is best?
Here is my C++ program:
#include <iostream>
int main () {
int a = 1;
int b = 2;
int c = 3;
a += b;
a = a + c;
std::cout << "Value of A is " << a << std::endl;
return 0;
}
An example of assembly differences:
GDB:
0x0000000100000f44 <+4>: sub $0x30,%rsp
0x0000000100000f48 <+8>: mov 0x10c1(%rip),%rdi # 0x100002010
0x0000000100000f4f <+15>: lea 0xfb6(%rip),%rsi
Godbolt.org:
sub rsp, 16
mov DWORD PTR [rbp-4], 1
mov DWORD PTR [rbp-8], 2
Otool -tv gave 13 more pages of code than the others so there is an obvious difference there.

Answer 1

The differences you are experiencing are not in the disassembled program, but rather in the syntax used to represent machine instructions.
Assembly is a very low-level language, in which there is a 1-to-1 mapping between machine instructions and mnemonics. The former are sequences of bits, possibly of variable length---as in the case of x86 architectures. This representation is directly interpreted by the CPU to carry out the work associated with the semantic of the instruction. Assembly language is a "human readable" representation of such sequences.
Basically, you can find any way to represent the same machine instruction. This is the assembly syntax.
Notoriously, for x86 architectures there exist two different syntaxes: AT&T and Intel. The output which you obtained from GBD is generated according to the AT&T syntax, while the output you got from Godbolt.org is Intel's.
Intel and AT&T syntax are very different from each other in appearance, and possibly this is why you have been thinking that the outcome is not the same. Actually, it's just a different way to represent the very same instructions.
These two "dialects" for the same architecture's assembly were born with different goals in mind. AT&T syntax was developed at AT&T labs to support the generation of programs for many different CPUs (see the book: Jeff Duntermann, Assembly Language Step-by-Step). At the time, AT&T was playing a major role in the history of computers. AT&T (Bell Labs) has been the source of Unix---its paradigm is currently (although partially) committed to by Linux---the C programming language, and many other fundamental tools that we continue to use today.
On the other hand, Intel syntax has been developed, well... by Intel for their own CPUs. Many adopters of the Intel syntax say that it is much neater when prorgamming on Intel CPUs. This might well be the case, as the syntax has been carefully crafted exactly for what the CPU supports.
While the AT&T syntax is no longer used at present days (at least, to the best of my knowledge) to write programs for CPUs other than x86, some of the "culprits" of the syntax are generated from it being more "general".
Then, which one to learn? My choice would be driven by the environment you work on. The whole Unix ecosystem (comprising Linux and Mac Os) has a toolchain (such as gas) which directly use that syntax. In the Linux kernel (and other low-level pieces of software) you will definitely find inlined assembly code in AT&T syntax to interact with the hardware. Windows systems, on the other hand, have toolchains (such as nasm) which speak the Intel syntax. While compile-time flags can ask these tools to switch to the other syntax (such as the -M flag for objdump), the habit is to adopt the "native" syntax.
With respect to the specific examples given in the question, they are "incompatible", in the sense that they refer to different portions of the disassembled code, so there is a higher degree of difference across the two.
Indeed, with respect to this GDB output:
sub $0x30, %rsp
mov 0x10c1(%rip), %rdi
lea 0xfb6(%rip), %rsi
the corresponding Intel disassembly would be:
sub rsp, 0x30
mov rdi, QWORD PTR [rip+0x10c1]
lea rsi, [rip+0xfb6]
On the other hand, with respect to the Godbolt.org output:
sub rsp, 16
mov DWORD PTR [rbp-4], 1
mov DWORD PTR [rbp-8], 2
the corresponding AT&T disassembly would be:
sub $0x10,%rsp
movl $0x1,-0x4(%rbp)
movl $0x2,-0x8(%rbp)
As you can see, the greatest difference, which might cause a lot of headaches, is related to the fact that the AT&T syntax places the source first and then the destination, while Intel syntax works the other way round.

Answer 2

The assembly sequences are not equivalents with different syntax, they are just different, probably due to using different compilers.
First pair:
sub $0x30,%rsp ;rsp -= 0x30
sub rsp,16 ;rsp -= 0x10
Next pair:
mov 0x10c1(%rip),%rdi ;rdi = [rip+0x10c1] (loads a value)
mov DWORD PTR [rbp-4],1 ;[rbp+4] = 1 (stores an immediate value)
Next pair:
lea 0xfb6(%rip),%rsi ;rsi = rip+0xfb6 (loads an offset)
mov DWORD PTR [rbp-8],2 ;[rbp+8] = 2 (stores an immediate value)
Both sequences are incomplete, but I don't think it matter much, as the shown sequences already show the differences.

Answer 3

Because there is not a 1 to 1 relationship between source code and assembly. The compiler would likely generate the same assembly for the following statements:
x = x + 1
and
x++;
both of which would be compiled to something like
add dword ptr [rdi], 1
So, when we dissassemble that, which one should it be disassembled to? x = x+1 or x++? This applies to virtually every statement of your program - if there is more than one way of expressing what happens in the source language, and the effects are the same, the compiler may choose to translate both of them to the same output. After which, you have no way of knowing which one was used.