YanoSec
Progress0 of 152 lessons complete

Course / 04 Code / Lesson 01 of 11

Bits, bytes, and hexadecimal

Estimated time: 15 min reading · 15 min activity

A file contains bytes, but a tool may display those bytes as pairs such as 41 or 2a. That display is called a hex dump. Reading the pairs lets you count the data and compare it with a later script without relying on how the file looks in an editor.

A bit has two possible values, 0 and 1. A byte contains eight bits and can represent a whole number from 0 through 255. Binary writes numbers with the digits 0 and 1. Decimal, the number system used for everyday counting, has ten digits. Hexadecimal, usually shortened to hex, has sixteen digits: 0–9 followed by a–f. The letters a–f stand for the values ten through fifteen.

Four bits are called a nibble. One hex digit can describe four bits, so two hex digits describe one byte. In the example, 0x marks a number as hexadecimal. The prefix helps the reader choose the number system; it adds no data to the byte.

Before you begin

Estimated time
15 min reading, 15 min activity. Setup and optional practice may take longer.
Where you work
Use the printed text and byte tables in this lesson, with paper or a text editor for notes. No account, installation, or terminal is needed. Each table supplies the complete evidence for its activity.
Without a lab
Work from the complete pair lists and source notes, make your prediction in notes, and compare with the activity’s stated result. The tables are authored models. Reading works without JavaScript. Answer checking needs JavaScript and a secure context, normally HTTPS or a local preview; saving additionally needs usable browser storage.

After this lesson you can:

  • Convert a displayed byte between hex, binary, and decimal.
  • Count bytes by grouping hex digits into pairs.
  • Distinguish a byte value from its size and its notation.

01Example

Read the same byte in three number systems. The left hex digit counts groups of sixteen; the right digit counts units. Thus 41 means 4 × 16 + 1, or decimal 65. Each four-bit group corresponds to one hex digit. This is a hand calculation.

Hex pair: 41
Nibbles: 0100 and 0001
Binary: 0100 0001
Decimal: 4x16+1 = 65
Size: 1 byte
Spaces in a dump separate pairs. They are not bits.

02Two digits, one byte

In a spaced dump, read one pair at a time. The pair 41 describes one byte; 41 41 describes two bytes even though both have the same value. Uppercase A–F and lowercase a–f have the same numeric meaning.

You can calculate each binary group by adding the place values 8, 4, 2, and 1. For 0100, only the 4 place is set. For 0001, only the 1 place is set. Together they give the hex pair 41. Eight binary place values, from left to right, are 128, 64, 32, 16, 8, 4, 2, and 1.

Keep value and size separate. The displayed byte 0x41 has value 65 and occupies one byte. The spaces and the 0x prefix belong to the way the number is written. If a byte dump ends with one unpaired hex digit, ask for the missing digit rather than inventing it.

Hex 41, binary 01000001 and decimal 65 are representations of the same one-byte value.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

Playback is optional. Step through at your own pace.

The supplied hex pair 41

Hex digits

4high hex digit
1low hex digit

Four-bit groups

0100high nibble
0001low nibble

Numeric value and size

0100 0001eight bits
4 × 16 + 1 = 65decimal value
1 byte = 8 bitsunchanged size

4 → 01004 maps to four bits 0100

1 → 00011 maps to four bits 0001

Each hex digit maps to four bits; the total remains one byte.

Follow the explanation

  1. Each hex digit maps to four bits; the total remains one byte.
  2. Join 0100 and 0001 to get eight bits 0100 0001.
  3. 4 × 16 + 1 = 65 describes the same one-byte value.
Read every state and value

1. Each hex digit maps to four bits; the total remains one byte.

Example
The supplied hex pair 41
Visible Item
4 · 1 · 0100 · 0001 · 1 byte = 8 bits
Current mappings
4 maps to four bits 0100 · 1 maps to four bits 0001
Annotations
None

2. Join 0100 and 0001 to get eight bits 0100 0001.

Example
The supplied hex pair 41
Visible Item
4 · 1 · 0100 · 0001 · binary · 1 byte = 8 bits
Current mappings
Join the two four-bit groups · Eight bits are one byte
Annotations
Item: binary; Text: The space is a presentation separator, not a bit.

3. 4 × 16 + 1 = 65 describes the same one-byte value.

Example
The supplied hex pair 41
Visible Item
4 · 1 · 0100 · 0001 · binary · decimal · 1 byte = 8 bits
Current mappings
Hex place values · Eight bits are one byte
Annotations
None
Hex 41, binary 01000001 and decimal 65 are representations of the same one-byte value.

03Convert a second byte and count a different dump

Use the worksheet for two related tasks: converting the byte 0x2a, then counting the pairs in a different dump. Work in notes first and compare with the printed checks afterward. No terminal or conversion tool is needed.

YanoSec / Code
Original byte worksheet. No program produced this card.

A bit is one binary digit: 0 or 1.
Binary place values for four bits, left to right: 8, 4, 2, 1.
Hex digits a, b, c, d, e, f represent decimal 10, 11, 12, 13, 14, 15.
A byte is eight bits.
A nibble is four bits, and one hexadecimal digit.
Two hexadecimal digits describe one byte.
A leading 0x is notation for a hexadecimal integer. It is not stored in the byte.

Worked byte: 0x41
Nibbles: 0100 and 0001
Binary: 0100 0001
Decimal: 65
Hex pair: 41
Size: 1 byte

Activity byte: 0x2a
Binary: 0010 1010
Decimal: 42
Hex pair: 2a
Size: 1 byte

Activity display, with spaces between pairs: 68 69 21 0a
Pair count: 4
These four pairs are four bytes. Do not read them as letters yet.
When reading a new display, count its own pairs instead of reusing a previous count.

Download the byte worksheet

  1. For 0x2a, split the digits into 2 and a. Write 2 as 0010 and ten as 1010. Join the groups: 0010 1010.
  2. Calculate 2 × 16 + 10. Compare your result with decimal 42 on the worksheet. The eight bits still occupy one byte.
  3. For 68 69 21 0a, mark each complete pair and count the marks. Compare with the worksheet: four pairs mean 4 bytes. You do not need to interpret them as letters.
  4. Circle the 0x prefix and the separating spaces in the displays. Explain why they are notation. Stop when you can distinguish the byte value from the byte count.

04Optional challenge

Spend about ten extra minutes converting 0x0f. The expected binary width is eight bits: 0000 1111. The decimal value is 15. Explain why the leading zeros preserve the displayed width while the value remains fifteen.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Byte case AOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Complete unspaced hex display: 08ac117f00d2
Two hexadecimal digits represent one byte.

Byte case BOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Independent byte: 0x36. Hex 3 means three groups of sixteen; hex 6 means six units. Binary nibble place values are 8, 4, 2, 1.

Byte case COwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

A copied display is 7a2. Its author claims it contains only complete hex pairs with no omitted digits. No padding rule is declared.

06Explain your prediction

Optional written self-check: Explain value, notation and byte count separately. Show a nibble calculation and identify any missing digit instead of silently repairing the display.

07Common mistakes

If a hex conversion gives the wrong value, write the place calculation before changing digits. For 2a, the a means ten units, so calculate 2 × 16 + 10.

If your byte count includes spaces or the 0x prefix, mark only the complete pairs. Count those marks rather than the printed characters.

If a byte display has an unpaired digit, leave the display unresolved and request the complete evidence. Adding a zero would change the evidence.

References