The fuzzy tale of an x/crypto vulnerability Michael McLoughlin Gophercon 2019 Lightning Talks Uber Advanced Technologies Group 8,140 lines of amd64 assembly in crypto 10,474 lines of amd64 assembly assembly in golang.org/x/crypto Fuzzing Fuzzing is an automated testing technique for hardening safety-critical software Typically used where code must handle untrusted inputs or correctness is paramount: 0 }  crypto/aes (GCM mode)  crypto/elliptic (P256)  crypto/sha1  crypto/sha256  crypto/sha512  x/crypto/chacha20poly1305  x/crypto/sha3  x/crypto/blake2b  x/crypto/blake2s  x/crypto/argon2

Better x86 Assembly Generation with Go Michael McLoughlin Gophercon 2019 Uber Advanced Technologies Group Assembly Language Go provides the ability to write functions in assembly language. Assembly Product SHA-1 Future Go Assembly Primer Hello, World! package add // Add x and y. func Add(x, y uint64) uint64 { return x + y } Go Disassembler The Go disassembler may be used to inspect generated ... add.go:5 0x2e7 488b442410 MOVQ 0x10(SP), AX add.go:5 0x2ec 488b4c2408 MOVQ 0x8(SP), CX add.go:5 0x2f1 4801c8 ADDQ CX, AX add.go:5 0x2f4 4889442418 MOVQ AX, 0x18(SP) add.go:5 0x2f9 c3 RET TEXT

distributions are available for the FreeBSD, Linux, Mac OS X (Snow Leopard/Lion), and Windows operating systems and the 32-bit (386) and 64-bit (amd64) x86 processor architectures. If a binary distribution /etc/profile (for a system-wide installation) or $HOME/.profile: export PATH=$PATH:/usr/local/go/bin Mac OS X Open the package file and follow the prompts to install the Go tools. The package installs the Go distribution convention is that the package name is the last element of the import path: the package imported as "crypto/rot13" should be named rot13. There is no requirement that package names be unique across all packages

it will show you some useful system information. Find the line that says "system type" -if you see "x64-based PC" that means your operating system is 64-bit, 32-bit otherwise. I strongly recommend downloading system will show the following: x86_64 x86_64 x86_64 GNU/Linux // some machines such as Ubuntu 10.04 will show as following x86_64 GNU/Linux 32-bit operating systems instead show: $GOPATH/src/mymath/sqrt.go package mymath func Sqrt(x float64) float64 { z := 0.0 for i := 0; i < 1000; i++ { z -= (z*z - x) / (2 * x) } return z } Now my package directory

型”一行中，若显示“x64-based PC”，即为64位系统；若显示“X86-based PC”，则为32位系统。 Mac系统用户建议直接使用64位的，因为Go所支持的Mac OS X版本已经不支持纯32位处理器了。 8 Linux系统用户可通过在Terminal中执行命令uname -a来查看系统信息： 64位系统显示 <一段描述> x86_64 x86_64 x86_64 GNU/Linux GNU/Linux //有些机器显示如下，例如ubuntu10.04 x86_64 GNU/Linux 32位系统显示 <一段描述> i686 i686 i386 GNU/Linux Mac 安装 Mac 安装 访问下载地址，32位系统下载go1.0.3.darwin-386.pkg，64位系统下载go1.0.3.darwin-amd64.pkg，双击下载文件， 一路默认安装点击下一步 $GOPATH/src/mymath/sqrt.go源码如下： package mymath func Sqrt(x float64) float64 { z := 0.0 for i := 0; i < 1000; i++ { z -= (z*z - x) / (2 * x) } return z } ``` 这样我的应用包目录和代码已经新建完毕，注意：

consistent with the highest Go language version the release supports. For example, Go Toolchain 1.21.x supports all Go language versions from 1.0 to Go 1.21. The path to the bin subfolder in Go Toolchain StatRandomNumbers function. 34. x, y := StatRandomNumbers(num) 35. // Call two built-in functions (print and println). 36. print("Result: ", x, " + ", y, " = ", num, "? ") 37. println(x+y == num) 38. } Save line 19, x and y at line 34 are declared with the short variable declaration form. We have specified the type for variables a and b as int. Go compiler will deduce that the types of i, num, x and y are

consistent with the highest Go language version the release supports. For example, Go Toolchain 1.21.x supports all Go language versions from 1.0 to Go 1.21. The path to the bin subfolder in Go Toolchain function. 34 | x, y := StatRandomNumbers(num) 35 | // Call two built-in functions (print and println). 36 | print("Result: ", x, " + ", y, " = ", num, "? ") 37 | println(x+y == num) 38 line 19, x and y at line 34 are declared with the short variable declaration form. We have specified the type for variables a and b as int. Go compiler will deduce that the types of i, num, x and y are

consistent with the highest Go language version the release supports. For example, Go Toolchain 1.21.x supports all Go language versions from 1.0 to Go 1.21. The path to the bin subfolder in Go Toolchain function. 34| x, y := StatRandomNumbers(num) 35| // Call two built-in functions (print and println). 36| print("Result: ", x, " + ", y, " = ", num, "? ") 37| println(x+y == num) 38| } line 19, x and y at line 34 are declared with the short variable declaration form. We have specified the type for variables a and b as int. Go compiler will deduce that the types of i, num, x and y are

supported. En Envir vironment onment • Go 1.17+ • Node.js LTS (18) • Yarn 1.x INFO INFO We strongly suggest using Yarn 1.x to run and build Casdoor frontend. Using NPM might cause UI styling issues account: built-in/admin docker run \ -e driverName=mysql \ -e dataSourceName='user:password@tcp(x.x.x.x:3306)/' \ -p 8000:8000 \ casbin/casdoor:latest docker run -p 8000:8000 -v /folder/of/app.conf:/conf // Example for macOS out/ ├── out/make/zip/darwin/x64/casdoor-electron-example-darwin-x64-1.0.0.zip ├── ... └── out/casdoor-electron-example-darwin-x64/casdoor-electron-example.app/Contents/MacOS/casd

Lightweight type system. No implicit conversions: keep things explicit. Untyped unsized constants: no more 0x80ULL. Strict separation of interface and implementation. Run-time: Garbage collection. Strings, maps November 2, 2009 Basics const N = 1024 // just a number const str = “this is a 日本語 string\n” var x, y *float var ch = '\u1234' /* Define and use a type, T. */ type T struct { a, b int } var t0 *T = { X, Y float // Upper case means exported } func (p *Point) Scale(s float) { p.X *= s; p.Y *= s; // p is explicit } func (p *Point) Abs() float { return math.Sqrt(p.X*p.X + p.Y*p.Y) } x := &Point{