{"id":22111671,"url":"https://github.com/phx/lilendian","last_synced_at":"2025-07-25T07:32:05.713Z","repository":{"id":62576101,"uuid":"266858771","full_name":"phx/lilendian","owner":"phx","description":"A small program that simply returns escaped shell code in Little Endian format for whatever memory address you enter as the first argument.","archived":false,"fork":false,"pushed_at":"2021-10-11T16:31:02.000Z","size":686,"stargazers_count":5,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2024-11-16T07:15:39.308Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/phx.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-05-25T19:02:44.000Z","updated_at":"2021-10-11T16:31:04.000Z","dependencies_parsed_at":"2022-11-03T17:34:10.806Z","dependency_job_id":null,"html_url":"https://github.com/phx/lilendian","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/phx%2Flilendian","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/phx%2Flilendian/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/phx%2Flilendian/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/phx%2Flilendian/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/phx","download_url":"https://codeload.github.com/phx/lilendian/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":227543358,"owners_count":17785195,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-01T10:50:20.290Z","updated_at":"2024-12-01T10:50:21.191Z","avatar_url":"https://github.com/phx.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"![lil endian](https://raw.githubusercontent.com/phx/lilendian/master/lilendian.png)\n\n# lil endian\n\nThis program is comptaible with both Python 2 and 3.\n\nIt simply returns escaped shell code in Little Endian format for whatever memory address is submitted as the first argument.\n\nIt's smart enough to distinguish between addresses with an `0x` prefix and accounts for that.\n\nIf the address is only in the 64-bit range, you will only receive the 64-bit output.\n\nIf the address can fit in the x86_64 ranges, you will receive both 32 and 64-bit output.\n\n## Install for python3 via PyPI:\n\n`pip3 install lilendian`\n\n## Install for python2 via setup.py:\n\n`python setup.py install`\n\n## Run in place:\n\n`./lilendian [single memory address]`\n\n### Examples\n\n```\n$ ./lilendian deadbeef\n\\xef\\xbe\\xad\\xde\n\\xef\\xbe\\xad\\xde\\x00\\x00\\x00\\x00\n\n$ ./lilendian 0xdeadbeef\n\\xef\\xbe\\xad\\xde\n\\xef\\xbe\\xad\\xde\\x00\\x00\\x00\\x00\n\n$ ./lilendian 0x00007fffffffd980\n\\x80\\xd9\\xff\\xff\\xff\\x7f\\x00\\x00\n```\n\n### Shell script example snippet:\n\nLet's say you wanted to get a piece of 64-bit shellcode for `0xdeadbeef + 0xbadcafe + 0xcafebabe + 0xabadbabe`.\n\n```sh\nfor addr in {0xdeadbeef,0xbadcafe,0xcafebabe,0xabadbabe}; do\n  lilendian $addr | tail -1\ndone | tr -d \"\\n\"; echo\n\nOutput:\n\\xef\\xbe\\xad\\xde\\x00\\x00\\x00\\x00\\xfe\\xca\\xad\\x0b\\x00\\x00\\x00\\x00\\xbe\\xba\\xfe\\xca\\x00\\x00\\x00\\x00\\xbe\\xba\\xad\\xab\\x00\\x00\\x00\\x00  \n```\n\nCopy and paste that guy straight into your payload.\n\n### Calling from within `gdb`:\n\n```\n(gdb) ! lilendian 0xdeadbeef\n\\xef\\xbe\\xad\\xde\n\\xef\\xbe\\xad\\xde\\x00\\x00\\x00\\x00\n```\n\n### Future:\n\nI might tweak it in the future to take multiple memory addresses, but as of right now, it only outputs a single memory address.\n\nI have kept it short and simple to be easily scriptable, so I'll leave the rest up to you.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fphx%2Flilendian","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fphx%2Flilendian","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fphx%2Flilendian/lists"}