endianness

Published: April 3, 2024

Description

Know of little and big endian?

Download the source code to understand the challenge.

Connect to the remote service and have a hex converter ready (CyberChef, python, etc.).

nc titan.picoctf.net <PORT_FROM_INSTANCE>

Solution

This is a warm-up endianness challenge. Once you understand basic little-endian conversion here, advance to endianness-v2 for a more complex forensics application involving image file recovery.
  1. Step 1Capture the prompt
    The server prints a word (e.g., ffoxf). Convert it to hex - ffoxf → 66 66 6f 78 66.
    Learn more

    Each character maps to its ASCII hex value. ASCII is a 7-bit encoding where printable characters start at 0x20 (space) and run through 0x7E (~). You can look them up with man ascii or use Python: hex(ord('f'))0x66.

    The server is essentially asking: "if you stored this 5-character string in memory as a 32/40-bit integer, what bytes would you actually see?" To answer, you first need to know what bytes the characters correspond to - hence the ASCII conversion step.

  2. Step 2Flip to little endian
    Reverse the byte order: 66 78 6f 66 66. Submit without spaces/0x prefix (66786f6666).
    66786f6666
    Learn more

    Endianness describes the order in which bytes of a multi-byte value are stored in memory.

    • Big endian - most significant byte first. The "natural" order, like reading a number left-to-right. Network protocols (TCP/IP) use big endian, which is why it's also called network byte order.
    • Little endian - least significant byte first. x86 and ARM (in most modes) use this. So the number 0x12345678 is stored in memory as 78 56 34 12.

    This matters enormously in low-level programming: if you write a 32-bit integer to a file on an x86 machine and read it back on a big-endian system (some older MIPS, SPARC, PowerPC), the bytes are in the wrong order and the value comes out completely wrong. File formats like PNG and JPEG hard-code big endian (network order) in their specs so they're portable across architectures. Reverse-engineering binary file formats often requires knowing which endianness the original platform used.

Alternate Solution

Use the Binary to Hex tool on this site to quickly look up ASCII hex values for each character - then manually reverse the byte order to produce the little-endian answer without opening Python.

Related guides

How to Read and Analyze Hex Dumps

This challenge turns on understanding byte order in hex. The hex dumps guide covers endianness, xxd output format, and how to interpret multi-byte values from a binary dump.

Flag

picoCTF{3ndi4n_sw4p_su33ess_d58...}

After a handful of conversions the service prints the flag.

Want more picoCTF 2024 writeups?

Tools used in this challenge

Related reading

Do these first

What to try next