hexdump
30 Jul 2019Introduction
Sometimes you may need to investigate the contents of binary files. Simply using cat to view these details in your terminal can have all sorts of random effects due to control characters, etc. The utility hexdump allows you to look at the contents of these files in a sane way.
From the hexdump manpage:
display file contents in hexadecimal, decimal, octal, or ascii
In today’s article, we’ll walk through some example usages of this utiltiy.
Examples
For all of these examples, we’ll be using a 256 byte file of random binary. I generated this data on my system with the following command:
head -c 256 /dev/urandom > exampleThe initial view of this data now looks like this:
➜ ~ hexdump example
0000000 5103 7055 bd22 a3bf 2f36 fc05 3a80 5d5a
0000010 0e4c cbdd 06a7 9dc3 b104 2dae 0c3e e9e6
0000020 d01a dc5a 2eaf c01d 5336 d738 231c 0358
0000030 9133 eafa cd24 1206 0f71 988e 2349 648c
0000040 1eb8 7cf4 e7b8 4e61 a5e9 aa16 063f 9370
0000050 7bab e97d c197 6662 e99d 0b97 381a 9712
0000060 7e88 ed64 2b22 74b9 3f5b c68f ce00 5c6e
0000070 7d4c 5f5f ee66 6198 b812 f54d 740a 0343
0000080 d1ce 7092 2623 91fa f7a7 cc0a 961b 10dd
0000090 ea41 b512 806f 16ee 74bf 32dd fc13 6bc9
00000a0 7126 99b5 1a7c 7282 a464 93a4 aae1 6070
00000b0 8e28 e93a 5342 c6fd 027a 6837 1131 668e
00000c0 574b 5025 4e8c 0f6a d2bd 6b7a c8ec daa0
00000d0 9ebc 3c2d d288 0514 2493 1aca ffd0 684c
00000e0 9bdc d2c8 b1f5 f862 4c5c b6c4 b722 9397
00000f0 d4f6 2bf0 74a5 a00a 8007 5fc5 cf99 0701
0000100Formatting
Now things get interesting. The -e switch of the hexdump command allows us to specify a format string that controls the output to the terminal.
➜ ~ hexdump -v -e '"%07_ax |"' -e '16/1 "%_p" "|\n"' exampleUsing _a[dox] we can control how that offset down the left hand side looks. %07_ax pads the offset with a width of 7. 16/1 "%_p" will print 16 bytes using _p which prints using the default character set. The output of which looks like this:
0000000 |.QUp"...6/...:Z]|
0000010 |L..........->...|
0000020 |..Z.....6S8..#X.|
0000030 |3...$...q...I#.d|
0000040 |...|..aN....?.p.|
0000050 |.{}...bf.....8..|
0000060 |.~d."+.t[?....n\|
0000070 |L}__f..a..M..tC.|
0000080 |...p#&..........|
0000090 |A...o....t.2...k|
00000a0 |&q..|..rd.....p`|
00000b0 |(.:.BS..z.7h1..f|
00000c0 |KW%P.Nj...zk....|
00000d0 |..-<.....$....Lh|
00000e0 |......b.\L.."...|
00000f0 |...+.t....._....|Anytime this format encounters a non-printable character, a . is put in its place.
Builtin
-v -C gives a side-by-side of hex values along with the printable characters:
➜ ~ hexdump -v -C exampleThis is probably the most familliar:
0000000 03 51 55 70 22 bd bf a3 36 2f 05 fc 80 3a 5a 5d |.QUp"...6/...:Z]|
00000010 4c 0e dd cb a7 06 c3 9d 04 b1 ae 2d 3e 0c e6 e9 |L..........->...|
00000020 1a d0 5a dc af 2e 1d c0 36 53 38 d7 1c 23 58 03 |..Z.....6S8..#X.|
00000030 33 91 fa ea 24 cd 06 12 71 0f 8e 98 49 23 8c 64 |3...$...q...I#.d|
00000040 b8 1e f4 7c b8 e7 61 4e e9 a5 16 aa 3f 06 70 93 |...|..aN....?.p.|
00000050 ab 7b 7d e9 97 c1 62 66 9d e9 97 0b 1a 38 12 97 |.{}...bf.....8..|
00000060 88 7e 64 ed 22 2b b9 74 5b 3f 8f c6 00 ce 6e 5c |.~d."+.t[?....n\|
00000070 4c 7d 5f 5f 66 ee 98 61 12 b8 4d f5 0a 74 43 03 |L}__f..a..M..tC.|
00000080 ce d1 92 70 23 26 fa 91 a7 f7 0a cc 1b 96 dd 10 |...p#&..........|
00000090 41 ea 12 b5 6f 80 ee 16 bf 74 dd 32 13 fc c9 6b |A...o....t.2...k|
000000a0 26 71 b5 99 7c 1a 82 72 64 a4 a4 93 e1 aa 70 60 |&q..|..rd.....p`|
000000b0 28 8e 3a e9 42 53 fd c6 7a 02 37 68 31 11 8e 66 |(.:.BS..z.7h1..f|
000000c0 4b 57 25 50 8c 4e 6a 0f bd d2 7a 6b ec c8 a0 da |KW%P.Nj...zk....|
000000d0 bc 9e 2d 3c 88 d2 14 05 93 24 ca 1a d0 ff 4c 68 |..-<.....$....Lh|
000000e0 dc 9b c8 d2 f5 b1 62 f8 5c 4c c4 b6 22 b7 97 93 |......b.\L.."...|
000000f0 f6 d4 f0 2b a5 74 0a a0 07 80 c5 5f 99 cf 01 07 |...+.t....._....|
00000100