Dword Justification

[NetNX]

Are dwords left or right justified? Or does it matter?

What i mean is if i have data that looks like this

00 00 00 0A <- is that a dword

-or-

0A 00 00 00

~_^ started logging other programs then bnet so there was no bnet docs im actually suprised i hadn't run into this problem before

[Ringo]

0A 00 00 00 would be 0xA000000 (thats a big number)
where as if it were a dword you should retreve it like:
00 00 00 0A
Making it
0xA

Hope that helps

[Eric]

In a little-endian environment, doublewords are read from memory from right to left.

[Newby]

For those who don't know (probably quite a few here), x86 is little-endian.

[LivedKrad]

In a little-endian environment, doublewords are read from memory from right to left.

For those who don't know (probably quite a few here), x86 is little-endian.

Which, as LoRd finally made clear to me, is going to mean the data is going to be read as such: 0x0000000A.

[MyndFyre]

0A 00 00 00 would be 0xA000000 (thats a big number)
where as if it were a dword you should retreve it like:
00 00 00 0A
Making it
0xA

Hope that helps

You have it backwards.

Big-endian 32-bit numbers behave as you indicated.  However, as Newby pointed out, x86 (what most of us work with) is little-endian.  00 00 00 0A would be read as 0x0a000000, a large number.

Endian-ness is the quality of which end (literally) of a number is the most significant.  For ease of understanding, let's work with a 16-bit number:

0x0a0c
0000 1010 0000 1100b (that's the number I gave represented in binary)
^------------------------------ (that's the most significant bit)
In Intel and other little-endian formats, the little end (the least significant byte) comes first:
0000 1100 0000 1010b         0c 0a
In big-endian formats like the Motorola 68000 CPUs, the big end (the most significant byte) comes first:
0000 1010 0000 1100b         0a 0c

We do the same for 32-bit and 64-bit numbers.  Consider the value 0x01020304:
Represented in binary:
0000 0001 0000 0010 0000 0011 0000 0100b
In Little-endian format:
0000 0100 0000 0011 0000 0010 0000 0001b         04 03 02 01

As Wikipedia notes, endianness is an arbitrary distinction, but highly important within-system (so that you follow the convention throughout).

Also, note that endianness does not refer to a sequence of bytes (such as a C-style character array), but only to numeric representations.  However, when you store the constant 'IX86', 'SEXP', or 'WAR3' as a DWORD, we understand why the "string" appears to be reversed.

[NetNX]

0A 00 00 00 would be 0xA000000 (thats a big number)
where as if it were a dword you should retreve it like:
00 00 00 0A
Making it
0xA

Hope that helps

yes thanks very much

[iago]

0A 00 00 00 would be 0xA000000 (thats a big number)
where as if it were a dword you should retreve it like:
00 00 00 0A
Making it
0xA

Hope that helps

yes thanks very much

Read MyndFyre's, his is actually right. 

[Ringo]

Read MyndFyre's, his is actually right. 

Are you sure, cos i thought it was left.
Who knows

[Eric]

Read MyndFyre's, his is actually right. 

Are you sure

Yes.

[Ringo]

So i was wrong?

[MyndFyre]

So i was wrong?

If we were on big-endian machines, you were right.  Unfortunately, the better majority of us are on little-endian machines.

Read MyndFyre's, his is actually right. 

LoL, thanks iago.  That's the nicest thing you've ever said about me.

[Ringo]

I know, i was joking, but i was just useing "0A 00 00 00" as a example of raw data in a packet dump for example.
as nothing more than a 4 byte number, it would represent 0xA000000 in hex, where as if it were a DWORD, it would be obtained as 0xA.

Was just a simple answer to a simple question

[Eric]

I know, i was joking, but i was just useing "0A 00 00 00" as a example of raw data in a packet dump for example.
as nothing more than a 4 byte number, it would represent 0xA000000 in hex, where as if it were a DWORD, it would be obtained as 0xA.

You don't group raw data and if for some sick, twisted reason you did, 0A 00 00 00 would be read as 0x0000000A since you are infact treating it as a doubleword.  You're hanging yourself.

[Ringo]

really? are you sure?

[edit] - reply to lord's edit
It was a Eample of what makes a dword a dword and not just 4 bytes MMKAY?
Sorry i didnt over answer the main question!