Reverse Engineering & Binary Analysis Basics · 课时

字节序与字节排列

理解多字节值如何排列在内存和文件中，了解字节序为何容易让初学者困惑，并学会正确读取原始字节。

字节序与字节排列 是 CoddyKit 上的免费 Reverse Engineering & Binary Analysis Basics 课时。这是第 4 节课，共 4 节。你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。这是 Reverse Engineering & Binary Analysis Basics 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Reverse Engineering & Binary Analysis Basics 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Bytes Have an Order

You learned how data is represented in binaries. But a number like 0x12345678 occupies four bytes, and the CPU must decide which byte comes first in memory.

That decision is called endianness.

Little-Endian

In little-endian, the least significant byte is stored first (lowest address).

The value 0x12345678 is stored as the bytes 78 56 34 12. x86, x64, and most ARM systems use little-endian.

Value:   0x12345678
Memory:  78 56 34 12   (low -> high address)

Big-Endian

In big-endian, the most significant byte is stored first.

The same value 0x12345678 is stored as 12 34 56 78. Network protocols and some older RISC chips use big-endian, so it is also called network byte order.

Value:   0x12345678
Memory:  12 34 56 78   (low -> high address)

Why It Matters in RE

When you see raw bytes in a hex editor, you must apply the correct endianness to recover the real value. Misreading endianness turns a valid pointer into garbage.

Reading addresses
Parsing file headers
Interpreting struct fields

Reading a 4-Byte Integer

Suppose a hex dump shows the bytes 2A 00 00 00. On a little-endian machine that is the integer 42, not 0x2A000000.

Always know the platform before interpreting.

Bytes:  2A 00 00 00
LE int: 0x0000002A = 42
BE int: 0x2A000000 = 704643072

Seeing It in Code

This C snippet inspects the running machine's endianness by aliasing an int through a byte pointer.

#include <stdio.h>
int main(void) {
    unsigned int x = 0x12345678;
    unsigned char *p = (unsigned char *)&x;
    printf('First byte: %02X\n', p[0]);
    return 0;
}

Network Byte Order

Protocols standardize on big-endian so machines of different architectures agree. C provides conversion helpers like htons and ntohl.

When reversing network code, watch for these calls; they reveal which fields are multi-byte.

uint16_t port = htons(8080);  // host -> network order

Byte Swapping

Converting between endian formats means reversing the byte order. Tools and disassemblers often offer a one-click swap, but understanding the mechanism is essential.

uint32_t swap32(uint32_t v) {
    return ((v & 0xFF) << 24) |
           ((v & 0xFF00) << 8) |
           ((v >> 8) & 0xFF00) |
           ((v >> 24) & 0xFF);
}

Endianness in File Formats

Many file formats declare their endianness in a magic field. ELF stores EI_DATA in its header; TIFF starts with II (Intel/little) or MM (Motorola/big).

Reading this field first tells you how to parse the rest.

Common Pitfalls

Beginners often:

Read bytes left-to-right and forget to reverse for little-endian
Assume the target matches their own machine
Mix endianness mid-struct

When a pointer looks absurd, suspect endianness first.

Tools That Show Endianness

Most analysis tools let you toggle interpretation. In a hex editor you can flip between little- and big-endian data inspectors; disassemblers display the architecture's native order automatically.

When carving raw structures, always confirm the tool's current setting matches the target.

xxd -l 4 sample.bin
# 00000000: 2a00 0000   -> LE int = 42

Quick Check

How is the value 0x12345678 stored on a little-endian machine?

Recap

Endianness decides byte order for multi-byte values:

Little-endian: least significant byte first (x86/x64)
Big-endian: most significant first (network order)
Check the format's endianness field before parsing

Mastering this stops the most common 'garbage value' confusion in binary analysis.

常见问题解答

「字节序与字节排列」课时是免费的吗？

是的 — 「字节序与字节排列」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Reverse Engineering & Binary Analysis Basics 课程的其余内容，请升级到 CoddyKit PRO。 Reverse Engineering & Binary Analysis Basics 课程共包含 4 节课。

「字节序与字节排列」这节课中我会学到什么？

理解多字节值如何排列在内存和文件中，了解字节序为何容易让初学者困惑，并学会正确读取原始字节。你通过在浏览器中直接运行的动手代码来练习 Reverse Engineering & Binary Analysis Basics，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Reverse Engineering & Binary Analysis Basics 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Reverse Engineering & Binary Analysis Basics 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。这是第 4 节课，共 4 节。

「字节序与字节排列」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Reverse Engineering & Binary Analysis Basics 课中编写并运行代码吗？

能。每节 Reverse Engineering & Binary Analysis Basics 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

← 返回 Reverse Engineering & Binary Analysis Basics