MANUAL ANALYSIS: ADDRESSES
gef> x/wx 0x401000
0x401000 <_start>: 0x000001b8
* the most common format when examining addresses is HEX (x)
- used to examine addresses and registers containing hex data, such as memory
addresses, instructions, or binary data
- instead of mov eax,0x1, the output is 0x000001b8
- this is the machine code representation in little-endian formatting
- read as: b8 01 00 00 (BIG ENDIAN)
Last updated