byte order when reading hard drive MBR

Question

I printed the MBR of my Pentium M laptop's hard drive. Here is the command I used:

$ sudo od -N 512 -x /dev/sda

I would expect to get bytes in sequential order in the output, but it seems that every pair of bytes is reversed.

For example, the following 16 bytes describe the second partition:

0000700 .... .... .... .... .... .... .... 0080
0000720 0601 fe07 ffff 7886 0001 1990 0353

This is a bootable partition. So, the first byte in this partition entry should be 80. The 5th byte should have the filesystem code, which is "07" for NTFS. However, these show up in the 2nd and 6th positions, respectively.

Another example - the last 4 bytes should be the size of the partition. This makes sense as 0x03531990 (28.5GB). However, the output above is showing 1990 0353.

It looks like it is reversing every pair of bytes. As this is a little endian chip, I could see it putting the least significant byte first, but wouldn't it work from word size? That would be 4 bytes. The output above seems to be reversing every 2 bytes.

Very confused by this, any help would be greatly appreciated. Thanks!

Answer 1

Apparently, this is normal. See:

On all IBM PC, PC compatible or any other little-endian computers, hexadecimal numbers of two or more bytes are always stored on media or in memory in reverse order (for more efficient CPU processing). Thus, the MBR signature, hex number 0xAA55 (or AA55h), will appear in a disk editor as the sequence: 55 AA.

From http://en.wikipedia.org/wiki/Partition_table_%28master_boot_record%29 .

Answer 2

From od man page :

'-x' Output as hexadecimal two-byte units. Equivalent to '-t x2'.

and

you can specify the number of bytes to use in interpreting each number in the given data type by following the type indicator character with a decimal integer.

So, perhaps you'll prefer -t x1 (or -t x4 ) instead.