CTF Write-up: Endianness

1. Basic Concept#

Endianness = Byte order in memory and files.

Example: The number 0x12345678 (hex) - how is it stored?

A) Big Endian (Network Order)#

Address:   0x00   0x01   0x02   0x03
Data:      0x12   0x34   0x56   0x78

Big byte first → Like reading a book: left to right

Used by: Network protocols (TCP/IP), JPEG, PNG, Motorola processors

B) Little Endian (Host Order)#

Address:   0x00   0x01   0x02   0x03
Data:      0x78   0x56   0x34   0x12

Little byte first → Like reading a car model number: start from the end

Used by: x86 processors (Intel/AMD), Windows, most PCs

2. Real-World Example#

Number: 0x12345678

Both store the SAME number, but DIFFERENT byte order!

3. In Your File#

What you have:#

e0ff d8ff  ← Swapped!

Correct JPEG should be:#

ffd8 ffe0  ← Big Endian

Problem: System wrote data as Little Endian, but JPEG format expects Big Endian.

4. Simple Analogy#

Word "CAT":

• Big Endian: C → A → T = "CAT" ✓
• Little Endian: T → A → C = "TAC" ✗

Computer stored: "TAC"

Program expects: "CAT"

5. Challenge#

go to cyberchef select the operation =====> render image operation in cyberchef like you open an image with eog swap endianness in cyberchef like you swap the bytes from little endian to big endian

Key Takeaway#

Endianness is all about byte order. Different systems and formats use different orders, which can cause compatibility issues if not handled correctly.