Directoryentry Directory entry is just a structure.FilenameCluster#Attributeswhat?BytesDescription32explorer.exe1st character of the filenameHow?0-0（Ox00orOxe5meansunallocated)1-107+3charactersoffilename+extension.10工Xoepne11-11Fileattributes (e.g.,read only,hidden)815eXe.-16002300...S12-12Reserved.2431200000C4OF013-19Creationandaccesstimeinformation.High2bytesofthefirstclusteraddress20-21ClusterHigher2Lower2(OforFAT16andFAT12)bytesbytesaddress22-25Writtentimeinformation00002000819226-27Low2bvtesoffirstclusteraddressItisnot32,why?28-31File size16
Directory entry 16 • Directory entry is just a structure. Bytes Description 0-0 1 st character of the filename (0x00 or 0xe5 means unallocated) 1-10 7+3 characters of filename + extension. 11-11 File attributes (e.g., read only, hidden) 12-12 Reserved. 13-19 Creation and access time information. 20-21 High 2 bytes of the first cluster address (0 for FAT16 and FAT12). 22-25 Written time information. 26-27 Low 2 bytes of first cluster address. 28-31 File size. Lower 2 bytes Filename Attributes Cluster # explorer.exe . 32 How? e x p l o r e r e x e . . . . . . . . . 00 00 . . . . 20 00 00 C4 0F 00 0 7 8 15 16 23 24 31 what? 00 00 20 00 Higher 2 bytes Cluster address = 8192 It is not 32, why?
BigEndianvsLittleEndian. Endian-ness is about byte ordering.- It means the way that a machine (we mean the entirecomputer architecture) orders the bytes4-byte integer value:0x89ABCDEFEnding(small)valueEnding(small)valueinsmall addressin large addressIncreasingaddressIncreasingaddressSunEFCDAB8989ABCDEFoianUTRAULCOLittleBigendianendian17
Big Endian vs Little Endian 17 • Endian-ness is about byte ordering. – It means the way that a machine (we mean the entire computer architecture) orders the bytes. 4-byte integer value: 0x89ABCDEF Ending (small) value in small address Ending (small) value in large address 89 AB CD EF Increasing address EF CD AB 89 Increasing address Big endian Little endian