Endianer Pwns

This is a short article about the different byte sequences. For simplicity, I show the sequences up to 32 bit. For the example, I use a 32 bit register and name the bytes A, B, C and D where our data is stored. Typically, you have either big endian or little endian, but there are also exotic ones that are all middle or mixed endian.

Common Byte Orders

On the right side there is always the least significant byte and on the left side there is the most significant byte. The letters A to D show where the bytes are stored at the register, the address is increases from A to D.

For 16 bits the orders are:

• Little Endian (LE): BA

• Big Endian (BE): AB

For 32 bit the byte orders are:

• Little Endian (LE): DC BA

• Big Endian (BE): AB CD

• Mixed Little Endian (MLE): CD AB

• Mixed Big Endian (MBE): BA DC

Check it with the dump 50 6F 6E FF:

• The byte A at the register contains: 50

• The byte B at the register contains: 6F

• The byte C at the register contains: 6E

• The byte D at the register contains: FF

unsigned 16 bit little endian (BA)

signed 16 bit little endian (BA)

unsigned 16 bit big endian (AB)

signed 16 bit big endian (AB)

unsigned 32 bit little endian (DCBA)

signed 32 bit little endian (DCBA)

unsigned 32 bit big endian (ABCD)

signed 32 bit big endian (ABCD)

unsigned 32 bit mixed little endian (CDAB)

signed 32 bit mixed little endian (CDAB)

unsigned 32 bit mixed big endian (BADC)

signed 32 bit mixed big endian (BADC)

float 32 bit little endian (DCBA)

float 32 bit big endian (ABCD)

float 32 bit big endian (ABCD)

float 32 bit mixed big endian (BADC)

ascii little endian (DCBA)

ascii big endian (ABCD)

ascii mixed little endian (CDAB)

ascii mixed big endian (BADC)

utf-8 little endian (DCBA)

utf-8 big endian (ABCD)

utf-8 mixed little endian (CDAB)

utf-8 mixed big endian (BADC)

utf-16 little endian (DCBA)

utf-16 big endian (ABCD)

utf-16 mixed little endian (CDAB)

utf-16 mixed big endian (BADC)

utf-32 little endian (DCBA)

utf-32 big endian (ABCD)

utf-32 mixed little endian (CDAB)

utf-32 mixed big endian (BADC)

Now when looking at all the data, you need to know the byte order of the source and the destination it needs to be swapped to. In order to interpret the data correctly, one must also know what they represent.

Normally, it is easy since most processor architectures use either little endian or big endian (check the picture below). For 64 bit this continues exactly the same, only the middle or mixed endians are a bit lost, especially for 64 bit.

32 bit little ↔ big endian swap