Endianness and Memory Layout

When a CPU stores a multi-byte integer in memory, it must choose which byte goes at the lowest address. That choice is called endianness.

Key Idea

• Little-endian (x86/x86_64): the least-significant byte is stored at the lowest memory address.
• Big-endian (network order, many RISC architectures): the most-significant byte is stored at the lowest memory address.

The debugger always lists bytes from lowest address to highest address, left to right. Endianness tells you how the number was packed into those addresses. See Big-endian vs little-endian byte order.

Examples

A 32-bit integer with value 200:

• Hex form: 0x000000c8
• Bytes in human-readable order: 00 00 00 c8
• Stored in little-endian memory: c8 00 00 00
• Stored in big-endian memory: 00 00 00 c8

So if your x86 debugger shows:

c8 00 00 00

the value is 0x000000c8 = 200.

Pointers Too

Pointers are just integers. A 64-bit pointer whose value is 0x22dff73c would appear in little-endian memory as:

3c f7 df 22

This packing of values into x86/x86_64 memory is the topic of Endianness in x86/x86_64 Memory.

Mental Model

Think of a number as having a "little end" and a "big end." Little-endian puts the little end at the low address; big-endian puts the big end there. To reconstruct the value from a little-endian dump, read the bytes in reverse order.

Common Pitfall

Do not confuse the left-to-right order of a hex dump with the left-to-right order of written hex. Written hex 0x12345678 is always most-significant-first. A little-endian memory dump of that value would show:

78 56 34 12

not 12 34 56 78.

Quick Rule for x86 Dumps

To convert a little-endian byte sequence to its value:

1. Take the bytes as shown, low-to-high address.
2. Reverse their order.
3. Prefix with 0x and read as hex.

For example: a8 00 00 00 → reverse → 00 00 00 a8 → 0x000000a8 = 168.