Endianness understanding issue

Cyber Security Penetration Testing Professional
,
1

Hello Community people,

I am currently studying for my eCPPTv2 and I came across the 2 types of Endianness and I cannot understand the difference due to the confusion caused by the slide explanation, as understanding the topic is important for further topics.

I understood that Big-endian stores the MSB at the lowest address and LSB at the Highest address and the other way around for the Little endian, as explained in “Architecture Fundamentals - Study Guide” Slide page 80 & 81. However, on the same slide, on page 82, where it explains the example of storing “0B” byte using the little-endian and it says that it will be stored on the left “MSB” where it should be on the LSB.
Also, on “Understanding Buffer Overflows - Study Guide” page 42, it explains how Windows uses little-endian to store ABCD that equal to “0x44434241” in hex, as I understood that that LSB should be stored at Lowest address and MSB stored on Highest address i.e. 0x41424344.

Please can anyone explain this for me!

Thank you in advance.

3

Maybe it is of help to check the memory with a small piece of code

#include <stdio.h>


#if defined(sun) || defined(__sun)
#include <sys/byteorder.h>
static inline uint32_t bswap_32(uint32_t x)
{
    return (((x & 0x000000ffU) << 24) |
            ((x & 0x0000ff00U) <<  8) |
            ((x & 0x00ff0000U) >>  8) |
            ((x & 0xff000000U) >> 24));
}
#else
#include <endian.h>
#include <byteswap.h>
#endif


void printi(unsigned int* i,int bigEndian){
    char *p=(char *)i;
    printf("\t%p (+0) 0x%02x %s\n",p,*p,bigEndian?"(MSB)":"(LSB)");
    p++;
    printf("\t%p (+1) 0x%02x\n",p,*p);
    p++;
    printf("\t%p (+2) 0x%02x\n",p,*p);
    p++;
    printf("\t%p (+3) 0x%02x %s\n",p,*p,bigEndian?"(LSB)":"(MSB)");
}
void comparei(unsigned int i){
    unsigned int 
#if __BYTE_ORDER == __LITTLE_ENDIAN
    littleI=i, 
    bigI=bswap_32(i);
    printf("Comparing 0x%08x at %p\n",littleI,&littleI);
    printf("Little Endian (native):\n");
    printi(&littleI,0);
    printf("Big Endian:\n");
    printi(&bigI,1);
#elif __BYTE_ORDER == __BIG_ENDIAN
    littleI=bswap_32(i),
    bigI=i;
    printf("Comparing 0x%08x at %p\n",bigI,&bigI);
    printf("Big Endian (native):\n");
    printi(&bigI,1);
    printf("Little Endian:\n");
    printi(&littleI,0);
#endif
    printf("\n");
}
void comparec(char* c){
    unsigned int i= *(unsigned int *)c;
    printf("Comparing \"%s\" == 0x%08x\n",c,i);

    comparei(i);
}
int main(){
#if __BYTE_ORDER == __LITTLE_ENDIAN
    printf("Host System uses Little Endian\n");
#elif __BYTE_ORDER == __BIG_ENDIAN
    printf("Host System uses Big Endian\n");
#elif __BYTE_ORDER == __PDP_ENDIAN
    printf("Host System uses Middle Endian\nWe don't do that here\n");
    exit(2);
#else
#error "no byte order"
    exit(1);
#endif

    comparei(0xb);
    comparei(0x12345678);
    comparec("ABCD");
    comparec("ZYXW");
}
// lscpu | grep Endian
// Byte Order:                      Little Endian

Example output:

Host System uses Little Endian
Comparing 0x0000000b at 0x7ffc1f417120
Little Endian (native):
        0x7ffc1f417120 (+0) 0x0b (LSB)
        0x7ffc1f417121 (+1) 0x00
        0x7ffc1f417122 (+2) 0x00
        0x7ffc1f417123 (+3) 0x00 (MSB)
Big Endian:
        0x7ffc1f417124 (+0) 0x00 (MSB)
        0x7ffc1f417125 (+1) 0x00
        0x7ffc1f417126 (+2) 0x00
        0x7ffc1f417127 (+3) 0x0b (LSB)

Comparing 0x12345678 at 0x7ffc1f417120
Little Endian (native):
        0x7ffc1f417120 (+0) 0x78 (LSB)
        0x7ffc1f417121 (+1) 0x56
        0x7ffc1f417122 (+2) 0x34
        0x7ffc1f417123 (+3) 0x12 (MSB)
Big Endian:
        0x7ffc1f417124 (+0) 0x12 (MSB)
        0x7ffc1f417125 (+1) 0x34
        0x7ffc1f417126 (+2) 0x56
        0x7ffc1f417127 (+3) 0x78 (LSB)

Comparing "ABCD" == 0x44434241
Comparing 0x44434241 at 0x7ffc1f4170f0
Little Endian (native):
        0x7ffc1f4170f0 (+0) 0x41 (LSB)
        0x7ffc1f4170f1 (+1) 0x42
        0x7ffc1f4170f2 (+2) 0x43
        0x7ffc1f4170f3 (+3) 0x44 (MSB)
Big Endian:
        0x7ffc1f4170f4 (+0) 0x44 (MSB)
        0x7ffc1f4170f5 (+1) 0x43
        0x7ffc1f4170f6 (+2) 0x42
        0x7ffc1f4170f7 (+3) 0x41 (LSB)

Comparing "ZYXW" == 0x5758595a
Comparing 0x5758595a at 0x7ffc1f4170f0
Little Endian (native):
        0x7ffc1f4170f0 (+0) 0x5a (LSB)
        0x7ffc1f4170f1 (+1) 0x59
        0x7ffc1f4170f2 (+2) 0x58
        0x7ffc1f4170f3 (+3) 0x57 (MSB)
Big Endian:
        0x7ffc1f4170f4 (+0) 0x57 (MSB)
        0x7ffc1f4170f5 (+1) 0x58
        0x7ffc1f4170f6 (+2) 0x59
        0x7ffc1f4170f7 (+3) 0x5a (LSB)


Host System uses Big Endian
Comparing 0x0000000b at 0xafd2ea2c
Big Endian (native):
        0xafd2ea2c (+0) 0x00 (MSB)
        0xafd2ea2d (+1) 0x00
        0xafd2ea2e (+2) 0x00
        0xafd2ea2f (+3) 0x0b (LSB)
Little Endian:
        0xafd2ea28 (+0) 0x0b (LSB)
        0xafd2ea29 (+1) 0x00
        0xafd2ea2a (+2) 0x00
        0xafd2ea2b (+3) 0x00 (MSB)

Comparing 0x12345678 at 0xafd2ea2c
Big Endian (native):
        0xafd2ea2c (+0) 0x12 (MSB)
        0xafd2ea2d (+1) 0x34
        0xafd2ea2e (+2) 0x56
        0xafd2ea2f (+3) 0x78 (LSB)
Little Endian:
        0xafd2ea28 (+0) 0x78 (LSB)
        0xafd2ea29 (+1) 0x56
        0xafd2ea2a (+2) 0x34
        0xafd2ea2b (+3) 0x12 (MSB)

Comparing "ABCD" == 0x41424344
Comparing 0x41424344 at 0xafd2e9fc
Big Endian (native):
        0xafd2e9fc (+0) 0x41 (MSB)
        0xafd2e9fd (+1) 0x42
        0xafd2e9fe (+2) 0x43
        0xafd2e9ff (+3) 0x44 (LSB)
Little Endian:
        0xafd2e9f8 (+0) 0x44 (LSB)
        0xafd2e9f9 (+1) 0x43
        0xafd2e9fa (+2) 0x42
        0xafd2e9fb (+3) 0x41 (MSB)

Comparing "ZYXW" == 0x5a595857
Comparing 0x5a595857 at 0xafd2e9fc
Big Endian (native):
        0xafd2e9fc (+0) 0x5a (MSB)
        0xafd2e9fd (+1) 0x59
        0xafd2e9fe (+2) 0x58
        0xafd2e9ff (+3) 0x57 (LSB)
Little Endian:
        0xafd2e9f8 (+0) 0x57 (LSB)
        0xafd2e9f9 (+1) 0x58
        0xafd2e9fa (+2) 0x59
        0xafd2e9fb (+3) 0x5a (MSB)