Are dwords left or right justified? Or does it matter?
What i mean is if i have data that looks like this
00 00 00 0A <- is that a dword
-or-
0A 00 00 00
~_^ started logging other programs then bnet so there was no bnet docs im actually suprised i hadn't run into this problem before
0A 00 00 00 would be 0xA000000 (thats a big number) :P
where as if it were a dword you should retreve it like:
00 00 00 0A
Making it
0xA
Hope that helps
In a little-endian environment, doublewords are read from memory from right to left.
For those who don't know (probably quite a few here), x86 is little-endian.
Quote from: LoRd[nK] on July 14, 2005, 11:13 AM
In a little-endian environment, doublewords are read from memory from right to left.
Quote from: Newby on July 14, 2005, 11:31 AM
For those who don't know (probably quite a few here), x86 is little-endian.
Which, as LoRd finally made clear to me, is going to mean the data is going to be read as such: 0x0000000A.
Quote from: Ringo on July 14, 2005, 06:13 AM
0A 00 00 00 would be 0xA000000 (thats a big number) :P
where as if it were a dword you should retreve it like:
00 00 00 0A
Making it
0xA
Hope that helps
You have it backwards.
Big-endian 32-bit numbers behave as you indicated. However, as Newby pointed out, x86 (what most of us work with) is little-endian. 00 00 00 0A would be read as 0x0a000000, a large number.
Endian-ness is the quality of which end (literally) of a number is the most significant. For ease of understanding, let's work with a 16-bit number:
0x0a0c
0000 1010 0000 1100b (that's the number I gave represented in binary)
^------------------------------ (that's the most significant bit)
In Intel and other little-endian formats, the little end (the least significant
byte) comes first:
0000 1100 0000 1010b 0c 0a
In big-endian formats like the Motorola 68000 CPUs, the big end (the most significant
byte) comes first:
0000 1010 0000 1100b 0a 0c
We do the same for 32-bit and 64-bit numbers. Consider the value 0x01020304:
Represented in binary:
0000 0001 0000 0010 0000 0011 0000 0100b
In Little-endian format:
0000 0100 0000 0011 0000 0010 0000 0001b 04 03 02 01
As Wikipedia notes (http://en.wikipedia.org/wiki/Endianness), endianness is an arbitrary distinction, but highly important within-system (so that you follow the convention throughout).
Also, note that endianness does not refer to a sequence of bytes (such as a C-style character array), but only to numeric representations. However, when you store the constant 'IX86', 'SEXP', or 'WAR3' as a
DWORD, we understand why the "string" appears to be reversed.
Quote from: Ringo on July 14, 2005, 06:13 AM
0A 00 00 00 would be 0xA000000 (thats a big number) :P
where as if it were a dword you should retreve it like:
00 00 00 0A
Making it
0xA
Hope that helps
yes thanks very much
Quote from: NetNX on July 15, 2005, 12:48 AM
Quote from: Ringo on July 14, 2005, 06:13 AM
0A 00 00 00 would be 0xA000000 (thats a big number) :P
where as if it were a dword you should retreve it like:
00 00 00 0A
Making it
0xA
Hope that helps
yes thanks very much
Read MyndFyre's, his is actually right.
Quote from: iago on July 15, 2005, 08:22 AM
Read MyndFyre's, his is actually right.
Are you sure, cos i thought it was left.
Who knows :P
So i was wrong?
Quote from: Ringo on July 15, 2005, 11:47 AM
So i was wrong?
If we were on big-endian machines, you were right. Unfortunately, the better majority of us are on little-endian machines.
Quote from: iago on July 15, 2005, 08:22 AM
Read MyndFyre's, his is actually right.
LoL, thanks iago. That's the nicest thing you've ever said about me.
I know, i was joking, but i was just useing "0A 00 00 00" as a example of raw data in a packet dump for example.
as nothing more than a 4 byte number, it would represent 0xA000000 in hex, where as if it were a DWORD, it would be obtained as 0xA.
Was just a simple answer to a simple question ;)
Quote from: Ringo on July 15, 2005, 12:37 PM
I know, i was joking, but i was just useing "0A 00 00 00" as a example of raw data in a packet dump for example.
as nothing more than a 4 byte number, it would represent 0xA000000 in hex, where as if it were a DWORD, it would be obtained as 0xA.
You don't group raw data and if for some sick, twisted reason you did, 0A 00 00 00 would be read as 0x0000000A since you are infact treating it as a doubleword. You're hanging yourself.
really? are you sure?
[edit] - reply to lord's edit
It was a Eample of what makes a dword a dword and not just 4 bytes MMKAY? :)
Sorry i didnt over answer the main question!
Quote from: Ringo on July 15, 2005, 12:46 PM
really? are you sure?
No. It's all part of an evil conspiracy to confuse you.
Quote from: LoRd[nK] on July 15, 2005, 12:51 PM
Quote from: Ringo on July 15, 2005, 12:46 PM
really? are you sure?
No. It's all part of an evil conspiracy to confuse you.
OMG I KNEW IT!
So.. a dword is reversed?
Quote from: Ringo on July 15, 2005, 12:54 PM
Quote from: LoRd[nK] on July 15, 2005, 12:51 PM
Quote from: Ringo on July 15, 2005, 12:46 PM
really? are you sure?
No. It's all part of an evil conspiracy to confuse you.
OMG I KNEW IT!
So.. a dword is reversed?
No, err ugh, read Myndfyr's post
Confusion conspiracy 1
Ringo 0
:(
Actually, it goes from outside to in. So
00 00 00 0A = 0x000A0000
00 00 0A 00 = 0x0A000000
00 0A 00 00 = 0x0000000A
0A 00 00 00 = 0x00BBCCFF
Just to confuse things.