Does the GDB examine command reverse bytes?

Question

Does gdb reverse the order of bytes when printing out multiple word chunks (4 bytes)? If so, then why? Does this have anything to do with how programs read memory?

Here is an example code to demonstrate what I mean by reverse the order

// test.c
#include <stdio.h>

int main(int argc, char *argv[])
{
  int large = 33825;              // 1000 0100 0010 0001
  int zero = 0;                   // 0000 0000 0000 0000
  int ten = 10;                   // 0000 0000 0000 1010
  printf("GDB test program\n");
  return 0;
}

Compile & run program with gdb:

$ gcc -z execstack -g -fno-stack-protector test.c -o test
$ gdb test
(gdb) break 9
Breakpoint 1 at 0x8048441: file test.c, line 9.
(gdb) run
Breakpoint 1, main (argc=1, argv=0xbfffeff4) at test.c:9
9     return 0;

(gdb) # get the address of the ten variable (which has the smallest memory address location)
(gdb) print &ten 
$2 = (int *) 0xbfffef34

(gdb) # print the first byte of the ten variable
(gdb) x /1tb 0xbfffef34
0xbfffef34: 0000 1010

(gdb) # print the entire memory (4 bytes) allocated for the ten variable (0xbfffef34 - 0xbfffef38)
(gdb) x /1tw 0xbfffef34
0xbfffef34: 0000 0000 0000 0000 0000 0000 0000 1010
(gdb) # Why is "0000 0000" the first octet instead of "0000 1010"
(gdb) # It seems like the print order of the bytes are reversed


(gdb) # Another example
(gdb) # print the entire memory (4 bytes) allocated for the large variable (0xbfffef3c - 0xbfffef3f)
(gdb) x /1tw 0xbfffef3c
0xbfffef3c: 0000 0000 0000 0000 1000 0100 0010 0001

(gdb) x /1tb 0xbfffef3c
0xbfffef3c: 0010 0001

(gdb) x /1tb 0xbfffef3d
0xbfffef3d: 1000 0100

(gdb) x /1tb 0xbfffef3e
0xbfffef3e: 0000 0000

(gdb) x /1tb 0xbfffef3f
0xbfffef3f: 0000 0000

When I print the entire variable, it reads how I would normally read binary (most significant octet on the left)

When I print the first octet of the same variable it displays the least significant octet.

Is GDB rearranging the order of the octets to make it more readable? Does this have anything to do with how the computer reads memory?

Answer 1

print prints the variables as a human would expect them to be printed (as integers).

examine prints them as bytes in memory without modifying them to compensate for the endianness that the computer uses.