Context
This is a repost of my StackOverflow question which was incorrectly asked, as it does not relate to programming.
I'm playing Bandit on OverTheWire, and level thirteen requires unzipping various compressed file formats without knowing the file extension. To do this, I have been comparing the hexdump with file signatures from Gary Kessler's website.
What I've noticed however is that the hex signature appears backwards. For example, take this gz, tgz gzip
archive file:
0000000 8b1f 0808 5006 5eb4 0302 6164 6174 2e32
0000010 6962 006e 3d01 c202 42fd 685a 3139 5941
0000020 5326 8e59 1c4f 00c8 1e00 ff7f f9fb da7f
...
With the signature 8b1f 0808
is backwards, as compared to what Gary Kessler's website indicates:
1F 8B 08 .‹. GZ, TGZ GZIP archive file
VLT VLC Player Skin file
Question
Why is the signature backwards? 1F 8B 08
vs 8b1f 0808
. The first file encountered is a hexdump of an archive file, data.txt
, and has a proper signature of 1f8b 0808
(found using head data.txt
), which aligns perfectly with the signature. However, when I run xxd -r data.txt | hexdump
I once again 8b1f 0808
.
The comments on my StackOverflow question seem to indicate that it's related to big / little endianess, and pointed me towards the -g1
flag of xxd
, which stands for grouping.
This does provide the right output but I don't understand what grouping is or how it works.