This is a repost of my StackOverflow question which was incorrectly asked, as it does not relate to programming.
I'm playing Bandit on OverTheWire, and level thirteen requires unzipping various compressed file formats without knowing the file extension. To do this, I have been comparing the hexdump with file signatures from Gary Kessler's website.
What I've noticed however is that the hex signature appears backwards. For example, take this
gz, tgz gzip archive file:
0000000 8b1f 0808 5006 5eb4 0302 6164 6174 2e32 0000010 6962 006e 3d01 c202 42fd 685a 3139 5941 0000020 5326 8e59 1c4f 00c8 1e00 ff7f f9fb da7f ...
With the signature
8b1f 0808 is backwards, as compared to what Gary Kessler's website indicates:
1F 8B 08 .‹. GZ, TGZ GZIP archive file VLT VLC Player Skin file
Why is the signature backwards?
1F 8B 08 vs
8b1f 0808. The first file encountered is a hexdump of an archive file,
data.txt, and has a proper signature of
1f8b 0808 (found using
head data.txt), which aligns perfectly with the signature. However, when I run
xxd -r data.txt | hexdump I once again
The comments on my StackOverflow question seem to indicate that it's related to big / little endianess, and pointed me towards the
-g1 flag of
xxd, which stands for grouping.
This does provide the right output but I don't understand what grouping is or how it works.