Why in buffer overflow attacks do we reverse the address? Why do we use little endian format?

  • What exactly buffer overflow attack do you mean? There are billions of those. – ximaera Jan 17 '18 at 15:37
  • Stack based buffer overflow or ret2libc for example. – Inj3ct0r Jan 17 '18 at 15:47
  • 3
    We use little-endian format because we're attacking little-endian machines. If we were attacking big-endian machines we'd use big-endian format. – Mark Jan 17 '18 at 22:07

Why do we reverse the address/use little endian in buffer overflow attacks?

This statement isn't always true. On a big endian system, you would not represent the data in little endian.

On a little endian system, values are represented by the least significant byte first. So in memory, the 32-bit integer 0xDEADBEEF would be represented as 0xEFBEADDE.

When you are exploiting a buffer overflow and, for example, overwrite the return pointer to jump to a memory address that you control, you need to specify this address in little endian. I think that your question is asking why the little endian notation here is necessary, but that is simply because it is the format the processor understands. At risk of oversimplifying, you are effectively injecting machine code into memory, so it must match everything else. If you provided an address in big endian, you would get the wrong address, or perhaps a completely invalid one.

| improve this answer | |
  • Which system's are little endian and which systems are big endian ? – Inj3ct0r Jan 19 '18 at 20:07
  • @Inj3ct0r now that one is Googleable – multithr3at3d Jan 19 '18 at 21:11

Because in general the stack goes from the top of the memory to the bottom, thus the "data" you use is always written from low to high .

enter image description here


This means that your buffer overflow is occuring at a lower address regarding the data you are trying to overflow.

Check this links for further details

| improve this answer | |
  • I dont understand you.. yes i know that the stack go from the top to the bottom but.. why we use the data from low to high ? – Inj3ct0r Jan 17 '18 at 15:53
  • Because your buffer overflow is occuring at a lower address regarding the data you are trying to overflow – Soufiane Tahiri Jan 17 '18 at 16:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.