Why in buffer overflow attacks do we reverse the address? Why do we use little endian format?
Why do we reverse the address/use little endian in buffer overflow attacks?
This statement isn't always true. On a big endian system, you would not represent the data in little endian.
On a little endian system, values are represented by the least significant byte first. So in memory, the 32-bit integer
0xDEADBEEF would be represented as
When you are exploiting a buffer overflow and, for example, overwrite the return pointer to jump to a memory address that you control, you need to specify this address in little endian. I think that your question is asking why the little endian notation here is necessary, but that is simply because it is the format the processor understands. At risk of oversimplifying, you are effectively injecting machine code into memory, so it must match everything else. If you provided an address in big endian, you would get the wrong address, or perhaps a completely invalid one.