Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why can't I find the int value in a binary

Tags:

c

linux

elf

hexdump

I compiled the following program on a 64-bit linux machine:

#include <stdio.h>

main()
{
    int a = 12345;

    if (a == 12346)
        printf ("YES\n");

    return;
}

If I output the binary file using hexdump, I can find the 12346 (which is 303a in hex), but not the 12345 value (0x3039). Why is that?

(little or big endian should make no difference in finding that value)

like image 962
Matt Avatar asked Dec 23 '22 20:12

Matt


1 Answers

Here’s where the values are in the output of plain hexdump for me; look at the bolded areas.

0000500 39fc 0030 8100 fc7d 303a 0000 0a75 a4bf

If you were expecting to see 3039 as one group, that would explain the confusion. The actual bytes are:

fc 39 30 00 00 81 7d fc 3a 30 00 00 75 0a bf a4

If you don’t want hexdump to do its “helpful” default output where it reinterprets the input as a sequence of little-endian two-byte words, you could spend an hour figuring out how to use its format strings or just pick xxd instead.

like image 191
Ry- Avatar answered Dec 29 '22 23:12

Ry-