Print Page - Little endian, Big endian

Title: Little endian, Big endian
Post by: mrburkett on July 12, 2005, 10:02:35 PM

Code:
.
.
.
   mov   esi,OFFSET RecordBuffer

.IF word PTR [esi+71] == "16"
   jmp cont
.ELSEIF word PTR [esi+71] != "24"
   jmp   @B
.ENDIF

cont:
.
.
.

In this text, ascii, RecordBuffer, position 71 does, indeed, contain "16". But when using OllyDbg, the code is "3631", which is correct. Olly, in a comparison, does not see that as equal or zero flag = 0, and does a jnz when it should be je.

What am I missing?

Thanks,
Jim

Title: Re: Little endian, Big endian
Post by: mrburkett on July 12, 2005, 10:37:42 PM

Is my problem because I am using 'word ptr' instead of two separate byte comparisons, '31' with '1' and '36' with '6'?

Title: Re: Little endian, Big endian
Post by: Jeff on July 12, 2005, 10:47:49 PM

yes, it would be better to look at them as bytes (to minimise confusion). remember, in memory, it will be arranged in little endian (bytes are arranged from least significant and up for "grouped bytes"). so while the word (2 bytes interpreted "grouped together") represents "16", in memory, they are arranged as if it were '6','1'.

Title: Re: Little endian, Big endian
Post by: mrburkett on July 12, 2005, 10:50:28 PM

I fixed the problem with:

Code:

   mov      esi,OFFSET RecordBuffer

.IF ((byte ptr [esi+71] == "1") && (byte ptr [esi+72] == "6"))
   jmp cont
.ELSEIF ((byte ptr [esi+71] == "2") && (byte ptr [esi+72] == "4"))
   jmp   cont
.ENDIF
   jmp @B
cont:

Thanks Jeff

Jim

The MASM Forum Archive 2004 to 2012

General Forums => The Campus => Topic started by: mrburkett on July 12, 2005, 10:02:35 PM