• 0xed Mac
• 0xedb88320 Crc32

Hexadecimal Calculation—Add, Subtract, Multiply, or Divide

Convert Hexadecimal Value to Decimal Value

Convert Decimal Value to Hexadecimal Value

Bug Check 0xED: UNMOUNTABLEBOOTVOLUME.; 2 minutes to read; D; In this article. The UNMOUNTABLEBOOTVOLUME bug check has a value of 0x000000ED. This indicates that the I/O subsystem attempted to mount the boot volume and it failed. Windows 7 Forums is the largest help and support community, providing friendly help and advice for Microsoft Windows 7 Computers such as Dell, HP, Acer, Asus or a custom build. Gone are the days when ASCII meant just US-ASCII characters 0-127. For over a decade now, Latin-1 support (US-ASCII plus characters 160-255) has been the bare minimum for any Internet application, and support for Unicode (Latin-1 plus characters 256 and up) is becoming the rule more than the exception.

The hexadecimal number system (hex) functions virtually identically to the decimal and binary systems. Instead of using a base of 10 or 2 respectively, it uses a base of 16. Hex uses 16 digits including 0-9, just as the decimal system does, but also uses the letters A, B, C, D, E, and F (equivalent to a, b, c, d, e, f) to represent the numbers 10-15. Every hex digit represents 4 binary digits, called nibbles, which makes representing large binary numbers simpler. For example, the binary value of 1010101010 can be represented as 2AA in hex. This helps computers to compress large binary values in a manner that can be easily converted between the two systems.

Below are some typical conversions between hex, binary, and decimal values:

Hex/Decimal Conversion

Converting between decimal and hex involves understanding the place values of the different number systems. A more in depth discussion is available on the binary calculator page. Note that converting between decimal and hex is quite similar to converting between decimal and binary. The ability to perform the conversion of either should make the other relatively simple. As previously mentioned, hex functions using the base of 16. This means that for the value 2AA, each place value represents a power of 16. Starting from the right, the first 'A' represents the 'ones' place, or 16⁰. The second 'A' from the right represents 16¹, and the 2 represents 16². Remember that 'A' in hex is equivalent to 10 in decimal. Knowing this information, it is then possible to convert from hex to decimal, as shown below:

Converting from decimal to hex is slightly more involved, but uses the same concepts. Refer to the steps and example below. It is important to work through the example provided in conjunction with the listed steps in order to understand the process:

1. Find the largest power of 16 that is less than or equal to the number to be converted, which will be referred to as X.
2. Determine how many times the power of 16 found in Step 1 goes into X, and take note of that number.
3. Multiply the number found in Step 2 by the power of 16 and subtract this value from X. This new value will be referred to as Y.
   • Note that the number found in Step 2 will be the value written in the place value for the power of 16 that was found. If for example the largest power of 16 was found to be 16⁴, and the number in Step 2 found to be 3, the hex value would have the number 3 in its 16⁴ place value: 3qrst, where qrst represents the 16^{0 through 3} place values.
4. Repeat Steps 1-3 using Y as the new starting value. Continue the process until 16 is larger than the remaining value, and assign the remainder to the 16⁰ place value.
5. Assign each of the values found in each iteration of Step 2 to its respective place value to determine the hex value.

0xed Mac

Converting from hex to decimal utilizes the same principles, but is arguably simpler. Multiply each digit in the hex value by its corresponding place value, and find the sum of each result. The process is the same regardless of whether the hex value contains letter numerals or not.

Hex Addition

Hex addition follows the same rules as decimal addition with the only difference being the added numerals A, B, C, D, E, and F. It may be convenient to have the decimal equivalent values of A through F handy when performing hex operations if the values have not yet been committed to memory. Below is an example of hex addition. Work through the example, and refer to the text below it for further details.

18	1A	B
+	B	7	8
=	1	4	2	3

Hex addition involves calculating basic decimal addition while converting between hex and decimal when values larger than 9 (the numerals A through F) are present. In the example above, B + 8 in decimal is 11 + 8 = 19. 19_decimal is 13_hex, since there is 1 set of 16, with 3 left over. Just like in decimal addition, the 1 carries over to the next column. Hence, the next column works out to be 1 + A (10) + 7 = 18_decimal, or 12_hex. Carry over the 1 to the final column resulting in 1 + 8 + B (11) = 20_decimal, or 14_hex. This yields the result of 1423_hex.

Hex Subtraction

Hex subtraction can be computed much the same way as hex addition; by performing the operation while converting between hex and decimal values. The most significant difference between hex and decimal subtraction involves borrowing. When borrowing in hex, the '1' that is borrowed represents 16_decimal rather than 10_decimal. This is because the column that is being borrowed from is 16 times larger than the borrowing column (the same reason that the borrowed 1 in decimal represents 10). As long as this is noted, and conversions of the letter numerals A-F are done carefully, hex subtraction is not any more difficult than decimal subtraction. Work through the example, and refer to the text below it for further details.

5	D	1C
–	3	A	F
=	2	2	D

In the first column on the right of the above example, C, or 12_decimal, is smaller than F, or 15_decimal. As such, it is necessary to borrow from the next column. This reduces the D, to C, and lends 1, or 16_decimal to the first column. 16_decimal + 12_decimal - 15_decimal = 13_decimal, or D in the first column. The following columns require no borrowing, making the calculations simple. Since 1 was borrowed, C - A = 12_decimal - 10_decimal = 2, and 5 - 3 = 2 yielding the final result of 22D. In the case where the number being subtracted is larger than the number being subtracted from, simply change the positions of the numbers, calculate the subtraction, and add a negative sign to the result. If the above example were instead 3AF - 5DC, it would then be written as is, except that the solution would be -22D.

0xedb88320 Crc32

Hex Multiplication

Hex multiplication can be tricky because the conversions between hex and decimal when performing the operations require more effort since the numerals tend to be larger. Having a hexadecimal multiplication table can be helpful (one is provided below).Otherwise manual conversion between decimal and hex will be necessary for each step. Below is an example of hex multiplication. To the right of the example, each of the multiplication and addition steps are shown. Note that all of the numerals used are hex. Refer to the addition section if necessary.

F	A	3 × A = 1E; 1 carried to F
×	C	3	3 × F = 2D, + 1 = 2E
2	E	E	C × A = 78; 7 carried to F
+	B	B	8	0	C × F = B4, + 7 = BB
=	B	E	6	E

Hex Division

Long division in hex is identical to long division in decimal, except that the multiplication and subtraction occur in hex. It is also possible to convert to decimal and perform long division in decimal, then convert back once complete. For illustrative purposes, the division example will be calculated entirely in hex. As with multiplication, having a hexadecimal multiplication table (one is provided below) would be convenient while conducting hex division. Below is an example. Note that all numerals in the example are hex. Although no borrowing occurs in the example below, remember that borrowing in hex results in 16_decimal being borrowed, rather than 10_decimal. Refer to the hex subtraction section for further details.

Hexadecimal Multiplication Table

When assessing an application, one may run into files that have strange or unknown extensions or files not readily consumed by applications associated with those extensions. In these cases it can be helpful to look for tell-tale file format signatures and inferring how the application is using them based on these signatures, as well as how these formats may be abused to provoke undefined behavior within the application. To identify these common file format signatures one typically only need look as far as the first few bytes of the file in question. This is what’s often called “magic bytes”, a term referring to a block of arcane byte values used to designate a filetype in order for applications to be able to detect whether or not the file they plan to parse and consume is of the proper format. The easiest way to inspect the file in question will be to examine it with a hex editor. Personally for this task I prefer HxD for windows or hexdump under Linux, but really any hex editor should do just fine. With a few exceptions file format signatures are located at offset zero and generally occupy the first two to four bytes starting from the offset. Another notable detail is that these initial sequences of bytes are generally not chosen at random; that is most developers of a given format will choose a file signature whose ASCII representation will be fairly recognizable at a glance as well as unique to the format. This allows us to use the known ASCII representations of these signatures as a sort of mnemonic device to quickly identify a given file’s format. Here’s a few examples of common file signatures and their accompanying mnemonics:

Let’s take what we’ve learned so far and apply it toward an “unknown” file, calc.exe.

To avoid confusion it’s worth noting that the PE32 executable format actually contains at minimum two sets of magic bytes: one set for the DOS executable header for DOS system compatibility and the other set to mark the beginning of the PE32 executable header. In this screenshot I’ve highlighted the DOS header, where we can see that the beginning of said header is marked with “MZ”. Another characteristic of the DOS header that’s an immediate give-away is the text “This program cannot be run in DOS mode.”, which some may recognize as the error text displayed when one attempts to run a windows application in DOS mode.

Following the DOS header and preceding the PE header is what’s known as the rich header and is represented in our mnemonic list as the “…” between the DOS and PE magic bytes. This header remains largely undocumented, however, so examining it at length is unlikely to yield any insightful information.

Finally, following the DOS and rich headers comes the PE header marked by “PE..”, or the byte sequence x50x45x00x00 which indicates that this file is a PE32 executable. Identifying other formats will follow the same principle, only one will generally only need the first step of the above process to identify the file format.