> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2024/forensics/endianess-v2-medium.md).

# endianess-v2 (Medium)

<figure><img src="/files/a3Mvn7QniE30coAx1HCB" alt=""><figcaption></figcaption></figure>

***

### What is Endianness?&#x20;

"**Endianness** refers to the order in which bytes are arranged in memory. Different languages read their text in different orders. for example, English reads from left to right, while Arabic reads from right to left. **Endianness** works similarly for computers. If one computer reads bytes from left to right and another reads them from right to left, issues arise when these computers need to communicate."

"Endianness ensures that bytes in computer memory are read in a specific order. Each computer system is internally consistent with its own data, but the advent of the internet has led to more data sharing than ever before, and not all systems read data in the same order."

### Little Endian vs Big Endian

**Big Endian**: Most significant byte stored first (at the lowest memory address)

* Example: The number 0x12345678 is stored as: 12 34 56 78

```
Address:   00   01   02   03
Data:         12   34   56   78
```

What makes the byte more significant is its position. The number itself can be smaller, yet has more significance.&#x20;

* **Most Significant Byte (MSbyte)**: The byte that holds the highest position value.
* **Least Significant Byte (LSbyte)**: The byte that holds the lowest position value.

So like in the number 0x12345678 (which is 4 bytes since it has 8 numbers)

* **0x78** is in the "ones place" (rightmost byte) → contributes 0x78 = 120
* **0x12** is in the "millions place" (leftmost byte) → contributes 0x12000000 = 301,989,888

**Little Endian**: Least significant byte stored first (at the lowest memory address)

* Example: The number 0x12345678 is stored as: 78 56 34 12

Currently, most modern CPUs uses Little Endian to process bytes.&#x20;

***

Because bytes may be ordered different in data, we may to need to adjust the position of the bytes, which is what I'm guessing what we'll do in CTF. The first thing to do is to get the file, and edit the hex of the file. I'll drop the file in CyberChef.

***

<figure><img src="/files/Nz6uYlSG6Ke138NYvQLG" alt=""><figcaption></figcaption></figure>

I've listed the process. First thing to do, is to drop the file into cyber chef. Since it was all disordered in random data, we needed to convert to hex first. Next, if you such up "endianness" up in CyberChef, you have the filter "Swap Endianess". This just swaps it from Big Endian to little or to big.

Next since the challenge mentioned that its a 32 bit system, we put the word length as 4 bytes. Now that after we have the proper hex, we can see a JPEG magic byte.

<figure><img src="/files/MEGji0W5Z6Mm2uzJXSrK" alt=""><figcaption></figcaption></figure>

Knowing this, we need to put an additional "Render Image" from hex, and then we'll see the flag!