+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Coders Lounge (https://hackforums.net/forumdisplay.php?fid=5)
+---- Thread: [Assembly] Just a pointer doubt (/showthread.php?tid=5683676)
Just a pointer doubt - Uiqueblhats - Aug 1, 2017
Lets say a memory address is stored at another memory address
For example
0x12345678 is stored at 0x53246975
So when I see the memory dump at 0x53246975 will it be 12 34 56 78 or 78 56 34 12 because of little endian?
* - g4143 - Aug 1, 2017
(Aug 1, 2017 12:47 AM)Uiqueblhats Wrote: Lets say a memory address is stored at another memory address
For example
0x12345678 is stored at 0x53246975
So when I see the memory dump at 0x53246975 will it be 12 34 56 78 or 78 56 34 12 because of little endian?
Yes that's correct.
* - Uiqueblhats - Aug 1, 2017
(Aug 1, 2017 01:56 AM)g4143 Wrote: Yes that's correct.
So 78 56 34 12 is the answer?
* - g4143 - Aug 1, 2017
(Aug 1, 2017 02:08 AM)Uiqueblhats Wrote: So 78 56 34 12 is the answer?
You should read this - https://www.cs.umd.edu/class/sum2003/cmsc311/Notes/Data/endian.html
https://stackoverflow.com/questions/7179907/when-does-endianness-become-a-factor
* - Uiqueblhats - Aug 1, 2017
(Aug 1, 2017 02:53 AM)g4143 Wrote: You should read this - https://www.cs.umd.edu/class/sum2003/cmsc311/Notes/Data/endian.htmlSo debuggers like olly or windbg shows in little endian or reverse the order for simplicity of user
https://stackoverflow.com/questions/7179907/when-does-endianness-become-a-factor
* - g4143 - Aug 1, 2017
(Aug 1, 2017 04:27 AM)Uiqueblhats Wrote: So debuggers like olly or windbg shows in little endian or reverse the order for simplicity of user
When I worked with dumps I never had problems with endianess. If you are walking through exe's via dumps then you quickly get used to endianess.
* - Masm4ever - Aug 1, 2017
Test it:
Code
include \masm32\include\masm32rt.inc
.data
MyDwords dd 12345678h, 11111111h, 22222222h, 33333333h
.code
start:
mov edi, offset MyDwords
mov eax, [edi+0]
mov ebx, [edi+4]
mov ecx, [edi+8]
mov edx, [edi+12]
int 3 ; give Olly a chance
exit
end startIf you ready for some confusing things, use this one:
Code
include \masm32\include\masm32rt.inc
.data
MyDword dd 12345678h
MyWords dw 1234h, 5678h
MyBytes db 12h, 34h, 56h, 78h
MyDword2 dd 11223344h
.code
start:
mov edi, offset MyDword
mov eax, [edi+0]
mov ebx, [edi+4]
mov ecx, [edi+8]
mov edx, [edi+12]
int 3 ; give Olly a chance
exit
end start* - Flaws. - Aug 1, 2017
(Aug 1, 2017 02:08 AM)Uiqueblhats Wrote: So 78 56 34 12 is the answer?
To be blunt.
Yes, thats correct.
* - D3RP - Aug 4, 2017
(Aug 1, 2017 08:31 AM).Jasper Wrote: To be blunt.
Yes, thats correct.
Thanks for answering his question LMAO. I was also curious about this yes or no answer.
* - IllegalSkills - Aug 7, 2017
You're correct, yes. Good thinking!