Reputation: 55
I am doing a CTF challenge. I open a broken BMP image file with a hex editor (HexFiend). I highlight 4 bytes in hex 8E262C00
. In the bottom, HexFiend shows their value in decimal 2893454
. However, I use online hex to decimal converting tool, their value is 2384866304
.
Do anyone know how HexFiend comes up with 2893454
?. I believe it is a correct answer, because that is the size of the file.
Upvotes: 0
Views: 3800
Reputation: 11
I think it's the Big Endian and Little Endian things.
You should check out this online converting tool, BMP file format is the Little Endian, but i think the tool maybe convert it by Big Endian method.
try it: https://www.scadacore.com/tools/programming-calculators/online-hex-converter/
Upvotes: 1
Reputation: 2024
It's the endianness of the file.
A binary encoded file can be encoded with small or big endian. The difference is which succession the single bytes have, i.e. if you read them from left or from right. Note that the order of bits almost always is big endian. The natural way of reading is big ending; the bytes are stores as you would expect it. 8E262C00
becomes 8E 26 2C 00
. This file, however, seems to be stored in small endian format. The order is flipped. In other words; 8E262C00
now becomes 00 2C 26 8E
which then results in the decimal representation of 2893454
Upvotes: 2