การแทนข้อมูลในไบนารี

When you reverse engineer, you're looking at a program's raw binary form. This means understanding how all kinds of data—numbers, text, and more—are stored as sequences of bits and bytes.

A bit is the smallest unit, either 0 or 1. Eight bits make a byte. Everything a computer does, from calculations to displaying text, relies on these fundamental units.

Integers are whole numbers. They can be signed (positive or negative) or unsigned (only non-negative). The number of bytes used determines the range of values an integer can hold.

• Byte (8-bit): 0 to 255 (unsigned) or -128 to 127 (signed).
• Word (16-bit): Up to 65,535 (unsigned).
• DWord (32-bit): Up to ~4 billion (unsigned).
• QWord (64-bit): Much larger numbers!

Let's see how different integer sizes affect the maximum value. This Python code shows the max value for an unsigned 8-bit integer (a byte) and a signed 8-bit integer.

Numbers with decimal points, like 3.14 or -0.5, are called floating-point numbers. They are stored differently from integers to handle their fractional parts.

Most systems use the IEEE 754 standard for floats. This standard defines how a number's sign, exponent, and fractional part are represented in bits. Common sizes are 32-bit (single-precision) and 64-bit (double-precision).

Text characters are also stored as numbers. The most common mapping for English characters is ASCII, where each character (like 'A' or '!') corresponds to a specific 8-bit number.

For a wider range of characters (emojis, foreign languages), Unicode is used. UTF-8 is a popular Unicode encoding that uses 1 to 4 bytes per character, making it flexible and backward-compatible with ASCII.

A string is simply a sequence of these characters, often ending with a special null byte (0x00) to mark its end.

Here's how a simple string is represented as bytes using UTF-8. Notice how each character gets a numerical value.

When a piece of data, like a 32-bit integer, takes up more than one byte, there's a choice to be made: which byte comes first in memory? This order is called endianness.

• Big-endian: The most significant byte (MSB) comes first. Think of reading numbers left-to-right, like "123" where '1' is the most significant digit.
• Little-endian: The least significant byte (LSB) comes first. This is like writing "321" if '1' were the most significant.

Let's take the 32-bit hexadecimal number 0x12345678. This number has four bytes: 12, 34, 56, 78.

• Big-endian: Stores bytes in memory as 12 34 56 78 (MSB first).
• Little-endian: Stores bytes in memory as 78 56 34 12 (LSB first).

Most modern Intel/AMD CPUs (x86/x64) are little-endian. Network protocols often use big-endian.

Understanding endianness is crucial when you're working with raw binary data, especially across different systems or file formats.

• If you read a 32-bit integer from a big-endian file on a little-endian system without conversion, the value will be incorrect.
• Network packets often use big-endian, so analyzing network traffic requires awareness.
• Many embedded systems (like ARM processors) can be configured for either, adding complexity.

Imagine a 32-bit integer with the hexadecimal value 0xAABBCCDD is stored in memory. If the system is little-endian, what would be the order of bytes in memory, starting from the lowest address?

Great job! In this lesson, we explored how data is represented in binaries:

• Integers: Stored as signed or unsigned numbers, with size determining range.
• Floating-points: Use standards like IEEE 754 for decimals.
• Characters & Strings: Mapped to numbers (ASCII, UTF-8) and often null-terminated.
• Endianness: The byte order (big-endian or little-endian) for multi-byte data, critical for correct interpretation.

Understanding these fundamentals is key to interpreting any binary file or memory dump. Next, we'll look at common binary file formats!