same here i got lost around there

Little vs. big endian, two minute edition: when you write numbers, like 123 (= 1*100 + 2*10 + 3*1), you write the 3 in the ones place last, and the 1 in the biggest place (here 100s) first. That's big endian. If you write the ones place first and the biggest place last, e.g. write 321 to mean 3*1 + 2*10 + 1*100, that's little endian. The particular number we're looking at in the code, 0x62501203, is currently in big endian. What the particular step is about is converting it to a 4-digit base-256 number written in little endian (in python's `bytes` type). If you just want to do the conversion by hand, from int to int, you can just put in 0x03125062. Notice how each pair of hex digits has been swapped by its opposite: first and last swap, and the middle two swap. Each pair of hex digits corresponds to a single digit in base 16*16 = 256. Python v3.2 and newer has a `.to_bytes` method on int objects, so you could also do `(0x62501203).to_bytes(4, byteorder='little')` and get the desired result.

You don't understand something until you can explain it simply.

Can you send some good resources you found?

I'm no genius but as far as I know, nop sleds are used to guide the program to execute code when you don't know exactly where the code lies but you know the rough area. In this case you knew exactly where to go so the nop slide was indeed kind of useless, but I do believe he brought it up only so we could know it's a thing. The reason your malicious code could lie somewhere else in the system is if it didn't fit inside the initial payload, where the code itself is another payload and ended up going somewhere else in the system. A way to reach the code is by putting a long nop slide infront of it and initiating a jmp instruction somewhere inside the nop slide. This way you don't have to know where the code lies, only roughly where it is.

Really enjoyed it, I tried this once prior to watching this and realized where I stuffed up. (little endian addr), the mona script helps ALOT.. thanks.

Please refrain from using the word "trump(s)". It triggers my PTSD. ;)

@@bmbiz please refrain from writing such terrible comments. It triggers my triggerinator.

@@ldSt3345 please refrain from being a bub it triggers my bob

Thanks a lot! This is an amazing insight - i allways wondered how an overflow leads to execution :-p

Thank you John for the great video. Super Informative! The "beginner" approach is much appreciated.