ลำดับไบต์และการเรียงลำดับไบต์

You learned how data is represented in binaries. But a number like 0x12345678 occupies four bytes, and the CPU must decide which byte comes first in memory.

That decision is called endianness.

In little-endian, the least significant byte is stored first (lowest address).

The value 0x12345678 is stored as the bytes 78 56 34 12. x86, x64, and most ARM systems use little-endian.

In big-endian, the most significant byte is stored first.

The same value 0x12345678 is stored as 12 34 56 78. Network protocols and some older RISC chips use big-endian, so it is also called network byte order.

When you see raw bytes in a hex editor, you must apply the correct endianness to recover the real value. Misreading endianness turns a valid pointer into garbage.

• Reading addresses
• Parsing file headers
• Interpreting struct fields

Suppose a hex dump shows the bytes 2A 00 00 00. On a little-endian machine that is the integer 42, not 0x2A000000.

Always know the platform before interpreting.

This C snippet inspects the running machine's endianness by aliasing an int through a byte pointer.

Protocols standardize on big-endian so machines of different architectures agree. C provides conversion helpers like htons and ntohl.

When reversing network code, watch for these calls; they reveal which fields are multi-byte.

Converting between endian formats means reversing the byte order. Tools and disassemblers often offer a one-click swap, but understanding the mechanism is essential.

Many file formats declare their endianness in a magic field. ELF stores EI_DATA in its header; TIFF starts with II (Intel/little) or MM (Motorola/big).

Reading this field first tells you how to parse the rest.

Beginners often:

• Read bytes left-to-right and forget to reverse for little-endian
• Assume the target matches their own machine
• Mix endianness mid-struct

When a pointer looks absurd, suspect endianness first.

Most analysis tools let you toggle interpretation. In a hex editor you can flip between little- and big-endian data inspectors; disassemblers display the architecture's native order automatically.

When carving raw structures, always confirm the tool's current setting matches the target.

How is the value 0x12345678 stored on a little-endian machine?

Endianness decides byte order for multi-byte values:

• Little-endian: least significant byte first (x86/x64)
• Big-endian: most significant first (network order)
• Check the format's endianness field before parsing

Mastering this stops the most common 'garbage value' confusion in binary analysis.