1

Context

This is a repost of my StackOverflow question which was incorrectly asked, as it does not relate to programming.

I'm playing Bandit on OverTheWire, and level thirteen requires unzipping various compressed file formats without knowing the file extension. To do this, I have been comparing the hexdump with file signatures from Gary Kessler's website.

What I've noticed however is that the hex signature appears backwards. For example, take this gz, tgz gzip archive file:

0000000 8b1f 0808 5006 5eb4 0302 6164 6174 2e32
0000010 6962 006e 3d01 c202 42fd 685a 3139 5941
0000020 5326 8e59 1c4f 00c8 1e00 ff7f f9fb da7f
...

With the signature 8b1f 0808 is backwards, as compared to what Gary Kessler's website indicates:

1F 8B 08        .‹. GZ, TGZ         GZIP archive file
                        VLT         VLC Player Skin file

Question

Why is the signature backwards? 1F 8B 08 vs 8b1f 0808. The first file encountered is a hexdump of an archive file, data.txt, and has a proper signature of 1f8b 0808 (found using head data.txt), which aligns perfectly with the signature. However, when I run xxd -r data.txt | hexdump I once again 8b1f 0808.

The comments on my StackOverflow question seem to indicate that it's related to big / little endianess, and pointed me towards the -g1 flag of xxd, which stands for grouping.

This does provide the right output but I don't understand what grouping is or how it works.

1 Answer 1

0

Grouping in xxd refers to the number of bytes that are treated (and displayed) as a unit.

By default, xxd treats its input as groups of 2 bytes / 16 bits (a four digit hexadecimal number) stored in big-endian order.

This will have the effect that every group of two bytes from the input will be displayed in reversed order (but actually the correct order for a big-endian system).

I.e. the first two bytes from the input 18 8B will become one 16-bit number 8B18, which is exactly what you see.

When you change the xxd grouping to "1" with the option -g1, all bytes from the input will be interpreted as single-byte numbers (which obviously do not have an "endian-ness") and will be displayed in the order they are read from the input.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.