Aug 12, 2019

Little endian notation

This is a concept that used for data storing in computer memory. Actually there are two types of notations called little endian and big endian. Do you have ever heard a story called Gulliver's travels. If you have read the book or watched that awesome movie , there were two people who use two different ways to break there eggs . one of them break eggs from little side. they called little-endians. Other people break eggs from big side. So they are big-endians. :-)

[image credit: Jonathan_Swift] The reason to learn these concept is when we writing exploits we must have a good knowledge in little endian notation. Because Intel processors are using little endian notation. Do you remember that we had to care about this notation in protostar stack1 tutorial. What we wanted at there is overwrite modified variable with abcd , but we used dcba in our exploit. At that point I said you I'll explain that in another tutorial. This is that tut. :-) First of all let's see how data are storing in computer memory. Memory is something like following. memory

There are many small storage location s with a unique number associated with it. We can call that number as memory address of location. If we take this simply there are many locations for hold data and all of they have a address. You know that one byte is long 8 bits byte

A stored value on a byte will be look like following image. copied-a-value-to-byte

Now the time to understand endian notation. Take 0x4f223b4e for an example. It is a number in hexadecimal form. We want to store this in computer memory. In little-endian notation we store first byte of the value in highest place of given memory location. But in big-endian notation that is completely different. We store first byte of value in first(lowest) place of memory. In following image you'll see this clearly. 4f is the first byte and it was stored at final place. 4e stored in first place of memory. So this is little-endian notation. little-endian-byte