Endianness

It determines the byte order when storing multi-byte values in memory.

Little-Endian (x86/x64)

Least significant byte stored at the lowest address:

text

Value: 0x12345678
Address: 0x1000  0x1001  0x1002  0x1003
Memory:  [0x78]  [0x56]  [0x34]  [0x12]
         LSB                      MSB

Big-Endian

Most significant byte stored at the lowest address:

text

Value: 0x12345678
Address: 0x1000  0x1001  0x1002  0x1003
Memory:  [0x12]  [0x34]  [0x56]  [0x78]
         MSB                      LSB

Practical Implications

Reading memory dumps:

asm

mov dword [buffer], 0x41424344  ; Store "ABCD" in ASCII

; Memory view (little-endian):
; [buffer]   = 0x44 ('D')
; [buffer+1] = 0x43 ('C')
; [buffer+2] = 0x42 ('B')
; [buffer+3] = 0x41 ('A')

Network protocols:

Network byte order is big-endian
Must convert using htonl/ntohl (host-to-network-long / network-to-host-long)

Why it matters:

Binary file formats
Network communication
Cross-platform compatibility
Reverse engineering (reading raw memory/disks)

Why Networking Uses Big-Endian

When the protocol suite was standardized, most influential machines were big-endian: IBM System/360, Motorola 68000, and early Sun/HP workstations. The specs defined network byte order as big-endian, and nobody had a reason to change it — everyone converts with htonl/ntohl at the boundary, so interoperability is guaranteed.

Big-endian is also a natural fit for a wire protocol:

The most significant byte arrives first, so a value's magnitude is visible from its first byte
A receiver can start parsing a value before the full length arrives (streaming-friendly)
On-the-wire order matches the way numbers are written, which simplifies protocol debugging

Is One Better Than the Other?

On modern hardware there is no performance difference — the CPU handles both byte orders at the same speed. The tradeoffs are about convenience:

Little-endian is better for:

Widening values: low-order bytes stay in place, so a short* can be reinterpreted as an int* without moving data (the new high bytes are simply appended)
This is why x86, whose arithmetic is byte-oriented, was built little-endian — and its dominance made little-endian the de facto host standard

Big-endian is better for:

Integer comparison and sorting: like strings, values compare from the most significant byte, which suits routing/network code (this matters for byte-by-byte comparison, e.g. memcmp or sorting serialized keys — a single CPU cmp on a loaded value is endianness-agnostic)
Debugging: memory dumps read like written numbers (0x12345678 appears as 12 34 56 78)
Streaming: processing can begin before all bytes of a value arrive

Quick Check

asm

section .data
    test_val dd 0x01020304

section .text
    mov eax, [test_val]
    ; If memory shows: 04 03 02 01 -> Little-endian
    ; If memory shows: 01 02 03 04 -> Big-endian