Beginner Malware Analyst Endianness Cheat Sheet

🔑 One Mental Rule

Memory = little-endian Network = big-endian

🔍 Hex & Memory

• Reverse multi-byte integers
• Watch for 2-byte ports
• Watch for 4-byte timers
• Watch for DWORD IPs

🧠 Disassembly

• Immediates are already decoded
• Raw memory is not
• Manual decoding = your job

🌐 Network Traffic

• IP/TCP headers = big-endian
• Malware converts explicitly
• Compare memory vs packet values

🧬 Shellcode

• push 0x68732f2f → reverse it
• Strings are backward on purpose
• Byte order ≠ readability

Analyst Study Note (Condensed Reference)