Binary, Hex, and Data Units Explained

Every byte you inspect in a hex editor, every subnet mask you calculate, every file size a tool reports depends on a small set of number systems and unit conventions. Get these wrong and you'll misjudge a buffer size, misread a memory dump, or argue with a colleague over whether 1 KB is 1000 or 1024 bytes.

Binary: the base every computer actually speaks

Binary is base 2 — only 0 and 1. A single binary digit is a bit. Group 8 bits together and you get a byte, which can represent 256 distinct values (0 through 255 unsigned, or -128 through 127 signed two's complement).

When you see 01001000 that's 72 in decimal, which happens to be the ASCII code for 'H'. Converting by hand is just summing powers of 2 from the rightmost bit: 2^6 + 2^3 = 64 + 8 = 72. Tools like python3 -c "print(bin(72))" or xxd on a file will do this instantly, but understanding the math matters when you're reverse engineering a bitmask or working out flag values in a TCP header.

Hexadecimal: binary's shorthand

Hex is base 16, using 0-9 and A-F. It exists because binary is unreadable at scale and decimal doesn't map cleanly to byte boundaries. One hex digit represents exactly 4 bits, so two hex digits represent one full byte — 0x00 to 0xFF covers all 256 byte values with no wasted space.

This is why hex dumps are the default in tools like xxd, hexdump -C, or a disassembler's memory view. When you see 0x4D 0x5A at the start of a file, that's the MZ header identifying a Windows PE executable. Memory addresses, color codes (#FF5733), MAC addresses, and IPv6 addresses are all conventionally written in hex because it maps so cleanly onto the underlying byte and nibble structure.

Converting hex to decimal: 0x4D = (4 × 16) + 13 = 77. In Python, int('4D', 16) gets you there without hand math, and hex(77) goes the other way.

Where binary, decimal, and hex actually meet in practice

IP addresses are a good example of all three colliding. An IPv4 address like 192.168.1.1 is really four bytes: 11000000.10101000.00000001.00000001 in binary, or C0.A8.01.01 in hex. Subnetting math — figuring out whether two addresses are on the same network — is fundamentally binary AND operations against a subnet mask, even though we write everything in dotted decimal for convenience.

In digital forensics and malware analysis, you're constantly translating between these representations. A disassembler shows opcodes in hex, but the CPU executes raw binary, and register values often get interpreted as decimal offsets or ASCII strings depending on context. Knowing that 0x41 is both the number 65 and the ASCII character 'A' is the kind of pattern recognition that speeds up manual analysis considerably.

Data units: the 1000 vs 1024 problem

This is where people actually get burned. Storage manufacturers, filesystems, and operating systems don't always agree on what a